=== modified file 'django/contrib/admin/sites.py'
--- django/contrib/admin/sites.py	2010-01-09 20:11:01 +0000
+++ django/contrib/admin/sites.py	2010-01-09 22:45:02 +0000
@@ -139,7 +139,7 @@
         Returns True if the given HttpRequest has permission to view
         *at least one* page in the admin site.
         """
-        return request.user.is_staff
+        return request.user.is_active and request.user.is_staff
 
     def check_dependencies(self):
         """

=== modified file 'django/contrib/admin/templates/admin/base.html'
--- django/contrib/admin/templates/admin/base.html	2010-01-09 20:11:01 +0000
+++ django/contrib/admin/templates/admin/base.html	2010-01-09 22:46:11 +0000
@@ -22,7 +22,7 @@
         <div id="branding">
         {% block branding %}{% endblock %}
         </div>
-        {% if user.is_staff %}
+        {% if user.is_active and user.is_staff %}
         <div id="user-tools">
             {% trans 'Welcome,' %}
             <strong>{% firstof user.first_name user.username %}</strong>.

=== modified file 'django/contrib/admin/views/decorators.py'
--- django/contrib/admin/views/decorators.py	2010-01-09 20:11:01 +0000
+++ django/contrib/admin/views/decorators.py	2010-01-09 23:07:30 +0000
@@ -28,7 +28,7 @@
     member, displaying the login page if necessary.
     """
     def _checklogin(request, *args, **kwargs):
-        if request.user.is_staff:
+        if request.user.is_active and request.user.is_staff:
             # The user is valid. Continue to the admin page.
             return view_func(request, *args, **kwargs)
 

=== modified file 'django/contrib/auth/tests/auth_backends.py'
--- django/contrib/auth/tests/auth_backends.py	2009-12-30 22:12:57 +0000
+++ django/contrib/auth/tests/auth_backends.py	2010-01-09 23:14:00 +0000
@@ -29,6 +29,11 @@
         user.is_superuser = False
         user.save()
         self.assertEqual(user.has_perm('auth.test'), False)
+        user.is_staff = True
+        user.is_superuser = True
+        user.is_active = False
+        user.save()
+        self.assertEqual(user.has_perm('auth.test'), False)
 
     def test_custom_perms(self):
         user = User.objects.get(username='test')

=== modified file 'django/core/xheaders.py'
--- django/core/xheaders.py	2007-08-12 09:29:59 +0000
+++ django/core/xheaders.py	2010-01-09 23:45:50 +0000
@@ -18,7 +18,7 @@
     """
     from django.conf import settings
     if (request.META.get('REMOTE_ADDR') in settings.INTERNAL_IPS
-            or (hasattr(request, 'user') and request.user.is_authenticated()
+            or (hasattr(request, 'user') and request.user.is_active
                 and request.user.is_staff)):
         response['X-Object-Type'] = "%s.%s" % (model._meta.app_label, model._meta.object_name.lower())
         response['X-Object-Id'] = str(object_id)

=== modified file 'django/middleware/doc.py'
--- django/middleware/doc.py	2010-01-09 20:11:01 +0000
+++ django/middleware/doc.py	2010-01-10 00:06:28 +0000
@@ -12,7 +12,8 @@
         indicating the view function.  This is used by the documentation module
         to lookup the view function for an arbitrary page.
         """
-        if request.method == 'HEAD' and (request.META.get('REMOTE_ADDR') in settings.INTERNAL_IPS or request.user.is_staff):
+        if request.method == 'HEAD' and (request.META.get('REMOTE_ADDR') in settings.INTERNAL_IPS or
+                                         (request.user.is_active and request.user.is_staff)):
             response = http.HttpResponse()
             response['X-View'] = "%s.%s" % (view_func.__module__, view_func.__name__)
             return response

=== modified file 'tests/regressiontests/admin_views/tests.py'
--- tests/regressiontests/admin_views/tests.py	2010-01-05 18:24:27 +0000
+++ tests/regressiontests/admin_views/tests.py	2010-01-09 23:06:59 +0000
@@ -602,6 +602,20 @@
         self.failUnlessEqual(logged.object_id, u'1')
         self.client.get('/test_admin/admin/logout/')
 
+    def testDisabledPermissionsWhenLoggedIn(self):
+        self.client.login(username='super', password='secret')
+        superuser = User.objects.get(username='super')
+        superuser.is_active = False
+        superuser.save()
+
+        response = self.client.get('/test_admin/admin/')
+        self.assertContains(response, 'id="login-form"')
+        self.assertNotContains(response, 'Log out')
+
+        response = self.client.get('/test_admin/admin/secure-view/')
+        open('/home/maniac/Desktop/response.html', 'w').write(response.content)
+        self.assertContains(response, 'id="login-form"')
+
 class AdminViewStringPrimaryKeyTest(TestCase):
     fixtures = ['admin-views-users.xml', 'string-primary-key.xml']
 
@@ -622,7 +636,7 @@
         response = self.client.get('/test_admin/admin/admin_views/modelwithstringprimarykey/%s/history/' % quote(self.pk))
         self.assertContains(response, escape(self.pk))
         self.failUnlessEqual(response.status_code, 200)
- 
+
     def test_get_change_view(self):
         "Retrieving the object using urlencoded form of primary key should work"
         response = self.client.get('/test_admin/admin/admin_views/modelwithstringprimarykey/%s/' % quote(self.pk))

=== added directory 'tests/regressiontests/special_headers'
=== added file 'tests/regressiontests/special_headers/__init__.py'
=== added directory 'tests/regressiontests/special_headers/fixtures'
=== added file 'tests/regressiontests/special_headers/fixtures/data.xml'
--- tests/regressiontests/special_headers/fixtures/data.xml	1970-01-01 00:00:00 +0000
+++ tests/regressiontests/special_headers/fixtures/data.xml	2010-01-10 00:05:32 +0000
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<django-objects version="1.0">
+    <object pk="100" model="auth.user">
+        <field type="CharField" name="username">super</field>
+        <field type="CharField" name="first_name">Super</field>
+        <field type="CharField" name="last_name">User</field>
+        <field type="CharField" name="email">super@example.com</field>
+        <field type="CharField" name="password">sha1$995a3$6011485ea3834267d719b4c801409b8b1ddd0158</field>
+        <field type="BooleanField" name="is_staff">True</field>
+        <field type="BooleanField" name="is_active">True</field>
+        <field type="BooleanField" name="is_superuser">True</field>
+        <field type="DateTimeField" name="last_login">2007-05-30 13:20:10</field>
+        <field type="DateTimeField" name="date_joined">2007-05-30 13:20:10</field>
+        <field to="auth.group" name="groups" rel="ManyToManyRel"></field>
+        <field to="auth.permission" name="user_permissions" rel="ManyToManyRel"></field>
+    </object>
+    <object pk="1" model="special_headers.article">
+        <field type="TextField" name="text">text</field>
+    </object>
+</django-objects>

=== added file 'tests/regressiontests/special_headers/models.py'
--- tests/regressiontests/special_headers/models.py	1970-01-01 00:00:00 +0000
+++ tests/regressiontests/special_headers/models.py	2010-01-09 23:27:58 +0000
@@ -0,0 +1,4 @@
+from django.db import models
+
+class Article(models.Model):
+    text = models.TextField()

=== added directory 'tests/regressiontests/special_headers/templates'
=== added directory 'tests/regressiontests/special_headers/templates/special_headers'
=== added file 'tests/regressiontests/special_headers/templates/special_headers/article_detail.html'
--- tests/regressiontests/special_headers/templates/special_headers/article_detail.html	1970-01-01 00:00:00 +0000
+++ tests/regressiontests/special_headers/templates/special_headers/article_detail.html	2010-01-09 23:43:11 +0000
@@ -0,0 +1,1 @@
+{{ object }}

=== added file 'tests/regressiontests/special_headers/tests.py'
--- tests/regressiontests/special_headers/tests.py	1970-01-01 00:00:00 +0000
+++ tests/regressiontests/special_headers/tests.py	2010-01-10 00:04:43 +0000
@@ -0,0 +1,40 @@
+from django.test import TestCase
+from django.contrib.auth.models import User
+
+class SpecialHeadersTest(TestCase):
+    fixtures = ['data.xml']
+
+    def test_xheaders(self):
+        user = User.objects.get(username='super')
+        response = self.client.get('/special_headers/article/1/')
+        # import pdb; pdb.set_trace()
+        self.failUnless('X-Object-Type' not in response)
+        self.client.login(username='super', password='secret')
+        response = self.client.get('/special_headers/article/1/')
+        self.failUnless('X-Object-Type' in response)
+        user.is_staff = False
+        user.save()
+        response = self.client.get('/special_headers/article/1/')
+        self.failUnless('X-Object-Type' not in response)
+        user.is_staff = True
+        user.is_active = False
+        user.save()
+        response = self.client.get('/special_headers/article/1/')
+        self.failUnless('X-Object-Type' not in response)
+
+    def test_xview(self):
+        user = User.objects.get(username='super')
+        response = self.client.head('/special_headers/xview/')
+        self.failUnless('X-View' not in response)
+        self.client.login(username='super', password='secret')
+        response = self.client.head('/special_headers/xview/')
+        self.failUnless('X-View' in response)
+        user.is_staff = False
+        user.save()
+        response = self.client.head('/special_headers/xview/')
+        self.failUnless('X-View' not in response)
+        user.is_staff = True
+        user.is_active = False
+        user.save()
+        response = self.client.head('/special_headers/xview/')
+        self.failUnless('X-View' not in response)

=== added file 'tests/regressiontests/special_headers/urls.py'
--- tests/regressiontests/special_headers/urls.py	1970-01-01 00:00:00 +0000
+++ tests/regressiontests/special_headers/urls.py	2010-01-10 00:04:08 +0000
@@ -0,0 +1,10 @@
+# coding: utf-8
+from django.conf.urls.defaults import *
+from django.views.generic.list_detail import object_detail
+from models import Article
+import views
+
+urlpatterns = patterns('',
+    (r'^article/(?P<object_id>\d+)/$', object_detail, {'queryset': Article.objects.all()}),
+    (r'^xview/$', views.xview),
+)

=== added file 'tests/regressiontests/special_headers/views.py'
--- tests/regressiontests/special_headers/views.py	1970-01-01 00:00:00 +0000
+++ tests/regressiontests/special_headers/views.py	2010-01-09 23:56:03 +0000
@@ -0,0 +1,10 @@
+# -*- coding:utf-8 -*-
+from django.http import HttpResponse
+from django.utils.decorators import decorator_from_middleware
+from django.middleware.doc import XViewMiddleware
+
+xview_dec = decorator_from_middleware(XViewMiddleware)
+
+def xview(request):
+    return HttpResponse()
+xview = xview_dec(xview)

=== modified file 'tests/urls.py'
--- tests/urls.py	2009-03-22 07:58:29 +0000
+++ tests/urls.py	2010-01-10 00:00:02 +0000
@@ -35,4 +35,7 @@
 
     # conditional get views
     (r'condition/', include('regressiontests.conditional_processing.urls')),
+
+    # special headers views
+    (r'special_headers/', include('regressiontests.special_headers.urls')),
 )

