Ticket #10525: staff_member_required.patch

django/contrib/admin/views/decorators.py

@@ -27 +27 @@
     Decorator for views that checks that the user is logged in and is a staff
     member, displaying the login page if necessary.
     """
-    def _checklogin(request, *args, **kwargs):
+    def _checklogin_function(request, *args, **kwargs):
         if request.user.is_authenticated() and request.user.is_staff:
             # The user is valid. Continue to the admin page.
             return view_func(request, *args, **kwargs)
@@ -73 +73 @@
                 return http.HttpResponseRedirect(request.get_full_path())
             else:
                 return _display_login_form(request, ERROR_MESSAGE)
+    
+    def _checklogin_method(self,request, *args, **kwargs):
+        if request.user.is_authenticated() and request.user.is_staff:
+            # The user is valid. Continue to the admin page.
+            return view_func(self, request, *args, **kwargs)
 
-    return wraps(view_func)(_checklogin)
+        assert hasattr(request, 'session'), "The Django admin requires session middleware to be installed. Edit your MIDDLEWARE_CLASSES setting to insert 'django.contrib.sessions.middleware.SessionMiddleware'."
+
+        # If this isn't already the login page, display it.
+        if LOGIN_FORM_KEY not in request.POST:
+            if request.POST:
+                message = _("Please log in again, because your session has expired.")
+            else:
+                message = ""
+            return _display_login_form(request, message)
+
+        # Check that the user accepts cookies.
+        if not request.session.test_cookie_worked():
+            message = _("Looks like your browser isn't configured to accept cookies. Please enable cookies, reload this page, and try again.")
+            return _display_login_form(request, message)
+        else:
+            request.session.delete_test_cookie()
+
+        # Check the password.
+        username = request.POST.get('username', None)
+        password = request.POST.get('password', None)
+        user = authenticate(username=username, password=password)
+        if user is None:
+            message = ERROR_MESSAGE
+            if '@' in username:
+                # Mistakenly entered e-mail address instead of username? Look it up.
+                users = list(User.objects.filter(email=username))
+                if len(users) == 1 and users[0].check_password(password):
+                    message = _("Your e-mail address is not your username. Try '%s' instead.") % users[0].username
+                else:
+                    # Either we cannot find the user, or if more than 1
+                    # we cannot guess which user is the correct one.
+                    message = _("Usernames cannot contain the '@' character.")
+            return _display_login_form(request, message)
+
+        # The user data is correct; log in the user in and continue.
+        else:
+            if user.is_active and user.is_staff:
+                login(request, user)
+                return http.HttpResponseRedirect(request.get_full_path())
+            else:
+                return _display_login_form(request, ERROR_MESSAGE)
+    
+    import types
+    if isinstance(view_func,types.FunctionType):
+        # view_func is a function
+        return wraps(view_func)(_checklogin_function)
+    else:
+        # view_func is a method
+        return wraps(view_func)(_checklogin_method)