Ticket #12557: anonymous_permissions.diff

django/contrib/auth/backends.py

@@ -28 +28 @@
         Returns a set of permission strings that this user has through his/her
         groups.
         """
+        if user_obj.is_anonymous():
+            return set([])
         if not hasattr(user_obj, '_group_perm_cache'):
             cursor = connection.cursor()
             # The SQL below works out to the following, after DB quoting:
@@ -58 +60 @@
         return user_obj._group_perm_cache
 
     def get_all_permissions(self, user_obj):
+        if user_obj.is_anonymous():
+            return set([])
         if not hasattr(user_obj, '_perm_cache'):
             user_obj._perm_cache = set([u"%s.%s" % (p.content_type.app_label, p.codename) for p in user_obj.user_permissions.select_related()])
             user_obj._perm_cache.update(self.get_group_permissions(user_obj))

django/contrib/auth/models.py

@@ -397 +397 @@
     user_permissions = property(_get_user_permissions)
 
     def has_perm(self, perm, obj=None):
+        for backend in auth.get_backends():
+            if hasattr(backend, "has_perm"):
+                if obj is not None:
+                    if (backend.supports_object_permissions and
+                        backend.has_perm(self, perm, obj)):
+                            return True
+                else:
+                    if backend.has_perm(self, perm):
+                        return True
         return False
 
     def has_perms(self, perm_list, obj=None):
-        return False
+        """
+        Returns True if the user has each of the specified permissions.
+        If object is passed, it checks if the user has all required perms
+        for this object.
+        """
+        for perm in perm_list:
+            if not self.has_perm(perm, obj):
+                return False
+        return True
 
-    def has_module_perms(self, module):
+    def has_module_perms(self, app_label):
+        for backend in auth.get_backends():
+            if hasattr(backend, "has_module_perms"):
+                if backend.has_module_perms(self, app_label):
+                    return True
         return False
 
     def get_and_delete_messages(self):