Ticket #25057: 25057_inactive_user.diff

django/contrib/auth/models.py

@@ -59 +59 @@
     created for each Django model.
     """
     name = models.CharField(_('name'), max_length=255)
-    content_type = models.ForeignKey(ContentType)
+    content_type = models.ForeignKey(ContentType, verbose_name=_('content type'))
     codename = models.CharField(_('codename'), max_length=100)
     objects = PermissionManager()
 
@@ -251 +251 @@
     def get_all_permissions(self, obj=None):
         return _user_get_all_permissions(self, obj)
 
-    def has_perm(self, perm, obj=None):
+    def has_perm(self, perm, obj=None, check_active=True):
         """
         Returns True if the user has the specified permission. This method
         queries all available auth backends, but returns immediately if any
@@ -260 +260 @@
         provided, permissions for this specific object are checked.
         """
 
-        # Active superusers have all permissions.
-        if self.is_active and self.is_superuser:
+        if check_active and not self.is_active:
+            return False
+
+        # Superusers have all permissions.
+        if self.is_superuser:
             return True
 
         # Otherwise we need to check the backends.
         return _user_has_perm(self, perm, obj)
 
-    def has_perms(self, perm_list, obj=None):
+    def has_perms(self, perm_list, obj=None, check_active=True):
         """
         Returns True if the user has each of the specified permissions. If
         object is passed, it checks if the user has all required perms for this
         object.
         """
         for perm in perm_list:
-            if not self.has_perm(perm, obj):
+            if not self.has_perm(perm, obj, check_active):
                 return False
         return True
 
-    def has_module_perms(self, app_label):
+    def has_module_perms(self, app_label, check_active=True):
         """
         Returns True if the user has any permissions in the given app label.
         Uses pretty much the same logic as has_perm, above.
         """
-        # Active superusers have all permissions.
-        if self.is_active and self.is_superuser:
+        if check_active and not self.is_active:
+            return False
+
+        # Superusers have all permissions.
+        if self.is_superuser:
             return True
 
         return _user_has_module_perms(self, app_label)

tests/auth_tests/test_auth_backends.py

@@ -445 +445 @@
 
     def test_has_perm(self):
         self.assertEqual(self.user1.has_perm('perm', TestObj()), False)
-        self.assertEqual(self.user1.has_perm('inactive', TestObj()), True)
+        #self.assertEqual(self.user1.has_perm('inactive', TestObj()), True) # Why?
+        # Inactive user should not have any permissions!
+        self.assertEqual(self.user1.has_perm('inactive', TestObj()), False)
 
     def test_has_module_perms(self):
         self.assertEqual(self.user1.has_module_perms("app1"), False)