Ticket #6363: 6363-1.diff

django/contrib/admin/sites.py

@@ -1 +1 @@
 from django import http, template
 from django.contrib.admin import ModelAdmin
-from django.contrib.auth import authenticate, login
+from django.contrib.auth import authenticate, login, logout
 from django.db.models.base import ModelBase
 from django.shortcuts import render_to_response
 from django.utils.safestring import mark_safe
@@ -243 +243 @@
         else:
             if user.is_active and user.is_staff:
                 login(request, user)
-                # TODO: set last_login with an event.
-                user.last_login = datetime.datetime.now()
-                user.save()
-                if request.POST.has_key('post_data'):
-                    post_data = _decode_post_data(request.POST['post_data'])
-                    if post_data and not post_data.has_key(LOGIN_FORM_KEY):
-                        # overwrite request.POST with the saved post_data, and continue
-                        request.POST = post_data
-                        request.user = user
+                
+                if self.has_permission(request):                
+                    # TODO: set last_login with an event.
+                    user.last_login = datetime.datetime.now()
+                    user.save()
+                    if request.POST.has_key('post_data'):
+                        post_data = _decode_post_data(request.POST['post_data'])
+                        if post_data and not post_data.has_key(LOGIN_FORM_KEY):
+                            # overwrite request.POST with the saved post_data, and continue
+                            request.POST = post_data
+                            request.user = user
+                            return None
+                        else:
+                            request.session.delete_test_cookie()
+                            return http.HttpResponseRedirect(request.path)
+                    else:
                         return None
-                    else:
-                        request.session.delete_test_cookie()
-                        return http.HttpResponseRedirect(request.path)
-            else:
-                return self.display_login_form(request, ERROR_MESSAGE)
+                        
+                # logged in a user without permission to access this admin site, un-do that 
+                # and fall through to re-display the login form with an error message.
+                logout(request)
+
+            return self.display_login_form(request, ERROR_MESSAGE)
     login = never_cache(login)
 
     def index(self, request, extra_context=None):