Ticket #7150: newforms-admin-view-permission-r7737.patch

db/models/options.py

@@ -296 +296 @@
     def get_delete_permission(self):
         return 'delete_%s' % self.object_name.lower()
 
+    def get_view_permission(self):
+        return 'view_%s' % self.object_name.lower()
+
     def get_all_related_objects(self, local_only=False):
         try:
             self._related_objects_cache

contrib/admin/options.py

@@ -319 +319 @@
         opts = self.opts
         return request.user.has_perm(opts.app_label + '.' + opts.get_delete_permission())
 
+    def has_view_permission(self, request, obj=None):
+        """
+        Returns True if the given request has permission to view the given
+        Django model instance.
+
+        If `obj` is None, this should return True if the given request has
+        permission to view *any* object of the given type.
+        """
+        opts = self.opts
+        return request.user.has_perm(opts.app_label + '.' + opts.get_view_permission())
+
     def queryset(self, request):
         """
         Returns a QuerySet of all model instances that can be edited by the
@@ -557 +568 @@
             # to determine whether a given object exists.
             obj = None
 
-        if not self.has_change_permission(request, obj):
+        if not (self.has_change_permission(request, obj) or (not request.POST and self.has_view_permission(request, obj))):
             raise PermissionDenied
 
         if obj is None:
@@ -625 +636 @@
         from django.contrib.admin.views.main import ChangeList, ERROR_FLAG
         opts = self.model._meta
         app_label = opts.app_label
-        if not self.has_change_permission(request, None):
+        if not (self.has_change_permission(request, None) or (not request.POST and self.has_view_permission(request, None))):
             raise PermissionDenied
         try:
             cl = ChangeList(request, self.model, self.list_display, self.list_display_links, self.list_filter,

contrib/admin/templatetags/admin_modify.py

@@ -16 +16 @@
         'show_save_and_add_another': context['has_add_permission'] and 
                             not is_popup and (not save_as or context['add']),
         'show_save_and_continue': not is_popup and context['has_change_permission'],
-        'show_save': True
+        'show_save': change and context['has_change_permission'] or context['add'] and context['has_add_permission']
     }
 submit_row = register.inclusion_tag('admin/submit_line.html', takes_context=True)(submit_row)

contrib/admin/templates/admin/index.html

@@ -19 +19 @@
         <caption>{% blocktrans with app.name as name %}{{ name }}{% endblocktrans %}</caption>
         {% for model in app.models %}
             <tr>
-            {% if model.perms.change %}
+            {% if model.perms.change or model.perms.view %}
                 <th scope="row"><a href="{{ model.admin_url }}">{{ model.name }}</a></th>
             {% else %}
                 <th scope="row">{{ model.name }}</th>

contrib/admin/sites.py

@@ -276 +276 @@
                     'add': model_admin.has_add_permission(request),
                     'change': model_admin.has_change_permission(request),
                     'delete': model_admin.has_delete_permission(request),
+                    'view': model_admin.has_view_permission(request),
                 }
 
                 # Check whether user has any perm for this module.

contrib/auth/models.py

@@ -65 +65 @@
         - The "add" permission limits the user's ability to view the "add" form and add an object.
         - The "change" permission limits a user's ability to view the change list, view the "change" form and change an object.
         - The "delete" permission limits the ability to delete an object.
+        - The "view" permission limits the ability to view the change list and view the object detail page.
 
     Permissions are set globally per type of object, not per specific object instance. It is possible to say "Mary may change news stories," but it's not currently possible to say "Mary may change news stories, but only the ones she created herself" or "Mary may only change news stories that have a certain status or publication date."
 

contrib/auth/management/__init__.py

@@ -12 +12 @@
 def _get_all_permissions(opts):
     "Returns (codename, name) for all permissions in the given opts."
     perms = []
-    for action in ('add', 'change', 'delete'):
+    for action in ('add', 'change', 'delete', 'view'):
         perms.append((_get_permission_codename(action, opts), u'Can %s %s' % (action, opts.verbose_name_raw)))
     return perms + list(opts.permissions)