Ticket #18600: group_required_decorator.diff

django/contrib/auth/decorators.py

@@ -2 +2 @@
 from functools import wraps
 from django.conf import settings
 from django.contrib.auth import REDIRECT_FIELD_NAME
+from django.contrib.auth.models import Group
 from django.core.exceptions import PermissionDenied
 from django.utils.decorators import available_attrs
 
@@ -65 +66 @@
         # As the last resort, show the login form
         return False
     return user_passes_test(check_perms, login_url=login_url)
+
+
+def group_required(group, login_url=None, raise_exception=False):
+    """
+    Decorator for views that checks whether a user is member of a particular
+    group, redirecting to the log-in page if neccesary.
+    If the raise_exception parameter is given the PermissionDenied exception
+    is raised.
+    """
+    def check_group(user):
+        if user.is_in_group(group):
+            return True
+
+        # In case the 403 handler should be called raise the exception
+        if raise_exception:
+            raise PermissionDenied
+        # As the last resort, show the login form
+        return False
+    return user_passes_test(check_group, login_url=login_url)

django/contrib/auth/models.py

@@ -310 +310 @@
     def has_usable_password(self):
         return is_password_usable(self.password)
 
+    def is_in_group(self, group):
+        """
+        Returns True if the user is member of the given group. The group
+        can be given as the Group, the primary key id or the unique name
+        of the group.
+        """
+        if isinstance(group, Group):
+            return self.groups.filter(id=group.id).exists()
+        elif isinstance(group, int):
+            try:
+                g = Group.objects.get(pk=group)
+                return self.is_in_group(g)
+            except Group.DoesNotExist:
+                return False
+        elif isinstance(group, str):
+            try:
+                g = Group.objects.get(name=group)
+                return self.is_in_group(g)
+            except Group.DoesNotExist:
+                return False
+        else:
+            return False
+        
     def get_group_permissions(self, obj=None):
         """
         Returns a list of permission strings that this user has through his/her