Ticket #16862: django-16862.3.diff

django/contrib/admin/util.py

@@ -116 +116 @@
                                 None, (quote(obj._get_pk_val()),))
             p = '%s.%s' % (opts.app_label,
                            opts.get_delete_permission())
-            if not user.has_perm(p):
+            if not user.has_perm(p, obj):
                 perms_needed.add(opts.verbose_name)
             # Display a link to the admin page.
             return mark_safe(u'%s: <a href="%s">%s</a>' %
@@ -361 +361 @@
     for piece in pieces:
         field, model, direct, m2m = parent._meta.get_field_by_name(piece)
         # skip trailing data field if extant:
-        if len(reversed_path) == len(pieces)-1: # final iteration
+        if len(reversed_path) == len(pieces) - 1: # final iteration
             try:
                 get_model_from_relation(field)
             except NotRelationField:

tests/regressiontests/admin_util/models.py

@@ -1 +1 @@
 from django.db import models
+from django.contrib.auth.models import User
 
 
 class Article(models.Model):
@@ -17 +18 @@
         return "nothing"
     test_from_model_with_override.short_description = "not What you Expect"
 
+
 class Count(models.Model):
     num = models.PositiveSmallIntegerField()
     parent = models.ForeignKey('self', null=True)
@@ -24 +26 @@
     def __unicode__(self):
         return unicode(self.num)
 
+
 class Event(models.Model):
     date = models.DateTimeField(auto_now_add=True)
 
+
 class Location(models.Model):
     event = models.OneToOneField(Event, verbose_name='awesome event')
 
+
 class Guest(models.Model):
     event = models.OneToOneField(Event)
     name = models.CharField(max_length=255)
 
     class Meta:
         verbose_name = "awesome guest"
+
+
+class PrivilegedUser(User):
+    special_usernames = ['special']
+
+    def has_perm(self, perm, obj=None):
+        if obj and obj.username in self.special_usernames:
+            return True
+        return False

tests/regressiontests/admin_util/tests.py

@@ -6 +6 @@
 from django.contrib import admin
 from django.contrib.admin import helpers
 from django.contrib.admin.util import (display_for_field, label_for_field,
-    lookup_field, NestedObjects)
+    lookup_field, NestedObjects, get_deleted_objects)
 from django.contrib.admin.views.main import EMPTY_CHANGELIST_VALUE
 from django.contrib.sites.models import Site
+from django.contrib.auth.models import User
 from django.db import models, DEFAULT_DB_ALIAS
 from django import forms
 from django.test import TestCase
-from django.utils import unittest
 from django.utils.formats import localize
 from django.utils.safestring import mark_safe
 
-from .models import Article, Count, Event, Location
+from .models import Article, Count, Event, Location, PrivilegedUser
 
 
 class NestedObjectsTests(TestCase):
@@ -70 +70 @@
         # Should not require additional queries to populate the nested graph.
         self.assertNumQueries(2, self._collect, 0)
 
-class UtilTests(unittest.TestCase):
+class UtilTests(TestCase):
+    urls = 'regressiontests.admin_util.urls'
+
     def test_values_from_lookup_field(self):
         """
         Regression test for #12654: lookup_field
@@ -218 +220 @@
         )
         self.assertEqual(
             label_for_field("test_from_model", Article,
-                model_admin = MockModelAdmin,
-                return_attr = True
+                model_admin=MockModelAdmin,
+                return_attr=True
             ),
             ("not Really the Model", MockModelAdmin.test_from_model)
         )
@@ -266 +268 @@
         # safestring should not be escaped
         class MyForm(forms.Form):
             text = forms.CharField(label=mark_safe('<i>text</i>'))
-            cb   = forms.BooleanField(label=mark_safe('<i>cb</i>'))
+            cb = forms.BooleanField(label=mark_safe('<i>cb</i>'))
 
         form = MyForm()
         self.assertEqual(helpers.AdminField(form, 'text', is_first=False).label_tag(),
@@ -277 +279 @@
         # normal strings needs to be escaped
         class MyForm(forms.Form):
             text = forms.CharField(label='&text')
-            cb   = forms.BooleanField(label='&cb')
+            cb = forms.BooleanField(label='&cb')
 
         form = MyForm()
         self.assertEqual(helpers.AdminField(form, 'text', is_first=False).label_tag(),
                          '<label for="id_text" class="required inline">&amp;text:</label>')
         self.assertEqual(helpers.AdminField(form, 'cb', is_first=False).label_tag(),
                          '<label for="id_cb" class="vCheckboxLabel required inline">&amp;cb</label>')
+
+    def test_get_deleted_objects_has_perm(self):
+
+        class MockAdminSite:
+            name = 'admin-ns'
+            _registry = [User]
+
+        privileged_user = PrivilegedUser()
+
+        # privileged_user don't have permission to modify all users,
+        # but have permission to user with username 'test'
+        # get_deleted_objects have to pass object for privileges check
+        obj = User(username='special')
+        obj.save()
+        (deleted_objects, perms_needed, protected) = get_deleted_objects(
+            [obj], None, privileged_user, MockAdminSite(), None)
+        self.assertFalse(obj._meta.verbose_name in perms_needed)
+
+        obj = User(username='common')
+        obj.save()
+        (deleted_objects, perms_needed, protected) = get_deleted_objects(
+            [obj], None, privileged_user, MockAdminSite(), None)
+        self.assertTrue(obj._meta.verbose_name in perms_needed)

new file tests/regressiontests/admin_util/urls.py

@@ +1 @@
+from __future__ import absolute_import
+
+from django.conf.urls import patterns, url, include
+
+
+class URLObject(object):
+    def __init__(self, app_name, namespace):
+        self.app_name = app_name
+        self.namespace = namespace
+
+    def urls(self):
+        return patterns('',
+            url(r'^inner/(\d+)/$', 'empty_view', name='auth_user_change'),
+        ), self.app_name, self.namespace
+    urls = property(urls)
+
+testobj1 = URLObject('testapp', 'admin-ns')
+
+urlpatterns = patterns('regressiontests.admin_util.urls',
+    (r'^test1/', include(testobj1.urls)),
+)