Changeset 3625

Timestamp:

08/20/06 15:54:37 (2 years ago)

Author:

clong

Message:

[per-object-permissions] Updated admin pages to use contains_permission, this means the admin interface will now show the change list link to a user even if they only have change row level permissions on one of the objects. Right now, it does list all the objects and does not filter out those that the user does not have permissions on.

Files:

• django/branches/per-object-permissions/django/contrib/admin/templatetags/adminapplist.py (modified) (1 diff)
• django/branches/per-object-permissions/django/contrib/admin/views/main.py (modified) (4 diffs)

django/branches/per-object-permissions/django/contrib/admin/templatetags/adminapplist.py

@@ -28 +28 @@
-                    if m._meta.admin:
-                        if not m._meta.admin.hidden:
+                            #perms = {
+                                #'add': user.has_perm("%s.%s" % (app_label, m._meta.get_add_permission())),
+                                #'change': user.has_perm("%s.%s" % (app_label, m._meta.get_change_permission())),
+                                #'delete': user.has_perm("%s.%s" % (app_label, m._meta.get_delete_permission())),
+                            #}
+    
-                            perms = {
-has_perm("%s.%s" % (app_label, m._meta.get_add_permission())
-has_perm("%s.%s" % (app_label, m._meta.get_change_permission())
-has_perm("%s.%s" % (app_label, m._meta.get_delete_permission())
-
+contains_permission("%s.%s" % (app_label, m._meta.get_add_permission()), m
+contains_permission("%s.%s" % (app_label, m._meta.get_change_permission()), m
+contains_permission("%s.%s" % (app_label, m._meta.get_delete_permission()), m
+    
-    
-                            # Check whether user has any perm for this module.

django/branches/per-object-permissions/django/contrib/admin/views/main.py

@@ -312 +312 @@
-    opts = model._meta
-
-    if not request.user.has_perm(app_label + '.' + opts.get_change_permission()):
-        raise PermissionDenied
-
-    if request.POST and request.POST.has_key("_saveasnew"):
-        return add_stage(request, app_label, model_name, form_url='../../add/')
-
-    try:
-        manipulator = model.ChangeManipulator(object_id)
-    except ObjectDoesNotExist:
-        raise Http404
+
+    if not request.user.has_perm(app_label + '.' + opts.get_change_permission(), object=manipulator.original_object):
+        raise PermissionDenied
+
+    if request.POST and request.POST.has_key("_saveasnew"):
+        return add_stage(request, app_label, model_name, form_url='../../add/')
+
+
-
-    if request.POST:
@@ -419 +421 @@
-        return # Avoid recursing too deep.
-    opts_seen = []
-get_all_
+
-        if related.opts in opts_seen:
-            continue
@@ -502 +504 @@
-        raise Http404, "App %r, model %r, not found" % (app_label, model_name)
-    opts = model._meta
-
+
+
+
+
-        raise PermissionDenied
-    obj = get_object_or_404(model, pk=object_id)
-
-    # Populate deleted_objects, a data structure of all related objects that
@@ -742 +746 @@
-    if model is None:
-        raise Http404, "App %r, model %r, not found" % (app_label, model_name)
-has_perm(app_label + '.' + model._meta.get_change_permission()
+contains_permission(app_label + '.' + model._meta.get_change_permission(), model
-        raise PermissionDenied
-    try: