Ticket #820: view_permission_patch_1.patch

django/contrib/admin/templatetags/adminapplist.py

@@ -23 +23 @@
                             'add': user.has_perm("%s.%s" % (app_label, m._meta.get_add_permission())),
                             'change': user.has_perm("%s.%s" % (app_label, m._meta.get_change_permission())),
                             'delete': user.has_perm("%s.%s" % (app_label, m._meta.get_delete_permission())),
+                            'view': user.has_perm("%s.%s" % (app_label, m._meta.get_view_permission())),
                         }
 
                         # Check whether user has any perm for this module.

django/contrib/admin/views/main.py

@@ -74 +74 @@
     IS_POPUP_VAR = 'pop'
 
     mod, opts = _get_mod_opts(app_label, module_name)
-    if not request.user.has_perm(app_label + '.' + opts.get_change_permission()):
+    if not (request.user.has_perm(app_label + '.' + opts.get_view_permission()) or request.user.has_perm(app_label + '.' + opts.get_change_permission())):
         raise PermissionDenied
 
     lookup_mod, lookup_opts = mod, opts
@@ -446 +446 @@
                     result_repr = ' '
                 if j == 0: # First column is a special case
                     result_id = getattr(result, pk)
-                    raw_template.append('<th%s><a href="%s/"%s>%s</a></th>' % \
-                        (row_class, result_id, (is_popup and ' onclick="opener.dismissRelatedLookupPopup(window, %r); return false;"' % result_id or ''), result_repr))
+                    if request.user.has_perm(app_label + '.' + opts.get_change_permission()):
+                        raw_template.append('<th%s><a href="%s/"%s>%s</a></th>' % \
+                            (row_class, result_id, (is_popup and ' onclick="opener.dismissRelatedLookupPopup(window, %r); return false;"' % result_id or ''), result_repr))
+                    else:
+                        raw_template.append('<th%s>%s</th>' % (row_class, result_repr))
                 else:
                     raw_template.append('<td%s>%s</td>' % (row_class, result_repr))
             raw_template.append('</tr>\n')

django/contrib/admin/templates/admin/index.html

@@ -17 +17 @@
         <table>
         {% for model in app.models %}
             <tr>
-            {% if model.perms.change %}
+            {% if model.perms.view %}
                 <th><a href="{{ model.admin_url }}">{{ model.name }}</a></th>
             {% else %}
                 <th>{{ model.name }}</th>

django/core/meta/__init__.py

@@ -268 +268 @@
     def get_delete_permission(self):
         return 'delete_%s' % self.object_name.lower()
 
+    def get_view_permission(self):
+        return 'view_%s' % self.object_name.lower()
+
     def get_rel_object_method_name(self, rel_opts, rel_field):
         # This method encapsulates the logic that decides what name to give a
         # method that retrieves related many-to-one objects. Usually it just

django/core/management.py

@@ -31 +31 @@
     "Returns (codename, name) for all permissions in the given opts."
     perms = []
     if opts.admin:
-        for action in ('add', 'change', 'delete'):
+        for action in ('add', 'change', 'delete', 'view'):
             perms.append((_get_permission_codename(action, opts), 'Can %s %s' % (action, opts.verbose_name)))
     return perms + list(opts.permissions)