Ticket #7150: newforms-admin-view-permission.patch

db/models/options.py

@@ -292 +292 @@
     def get_delete_permission(self):
         return 'delete_%s' % self.object_name.lower()
 
+    def get_view_permission(self):
+        return 'view_%s' % self.object_name.lower()
+
     def get_all_related_objects(self, local_only=False):
         try:
             self._related_objects_cache

contrib/admin/options.py

@@ -290 +290 @@
         opts = self.opts
         return request.user.has_perm(opts.app_label + '.' + opts.get_delete_permission())
 
+    def has_view_permission(self, request, obj=None):
+        """
+        Returns True if the given request has permission to view the given
+        Django model instance.
+
+        If `obj` is None, this should return True if the given request has
+        permission to view *any* object of the given type.
+        """
+        opts = self.opts
+        return request.user.has_perm(opts.app_label + '.' + opts.get_view_permission())
+
+
     def queryset(self, request):
         """
         Returns a QuerySet of all model instances that can be edited by the
@@ -522 +534 @@
             # to determine whether a given object exists.
             obj = None
 
-        if not self.has_change_permission(request, obj):
-            raise PermissionDenied
+        if (not self.has_change_permission(request, obj)) and (request.POST or (not self.has_view_permission(request, obj) ) ) :
+                        raise PermissionDenied
 
         if obj is None:
             raise Http404('%s object with primary key %r does not exist.' % (opts.verbose_name, escape(object_id)))
@@ -588 +600 @@
         from django.contrib.admin.views.main import ChangeList, ERROR_FLAG
         opts = self.model._meta
         app_label = opts.app_label
-        if not self.has_change_permission(request, None):
-            raise PermissionDenied
+        if (not self.has_change_permission(request, None)) and (request.POST or (not self.has_view_permission(request, None) ) ) :
+                        raise PermissionDenied
         try:
             cl = ChangeList(request, self.model, self.list_display, self.list_display_links, self.list_filter,
                 self.date_hierarchy, self.search_fields, self.list_select_related, self.list_per_page, self)

contrib/admin/templates/admin/index.html

@@ -22 +22 @@
             {% if model.perms.change %}
                 <th scope="row"><a href="{{ model.admin_url }}">{{ model.name }}</a></th>
             {% else %}
+            {% if model.perms.view %}
+                <th scope="row"><a href="{{ model.admin_url }}">{{ model.name }}</a></th>
+            {% else %}
                 <th scope="row">{{ model.name }}</th>
-            {% endif %}
+            {% endif %}{% endif %}
 
             {% if model.perms.add %}
                 <td><a href="{{ model.admin_url }}add/" class="addlink">{% trans 'Add' %}</a></td>

contrib/admin/sites.py

@@ -268 +268 @@
                     'add': model_admin.has_add_permission(request),
                     'change': model_admin.has_change_permission(request),
                     'delete': model_admin.has_delete_permission(request),
+                    'view': model_admin.has_view_permission(request),
                 }
 
                 # Check whether user has any perm for this module.

contrib/auth/management.py

@@ -12 +12 @@
 def _get_all_permissions(opts):
     "Returns (codename, name) for all permissions in the given opts."
     perms = []
-    for action in ('add', 'change', 'delete'):
+    for action in ('add', 'change', 'delete', 'view'):
         perms.append((_get_permission_codename(action, opts), u'Can %s %s' % (action, opts.verbose_name_raw)))
     return perms + list(opts.permissions)
 

contrib/auth/models.py

@@ -65 +65 @@
         - The "add" permission limits the user's ability to view the "add" form and add an object.
         - The "change" permission limits a user's ability to view the change list, view the "change" form and change an object.
         - The "delete" permission limits the ability to delete an object.
+        - The "view" permission limits the ability to just watch the content of an object.
 
     Permissions are set globally per type of object, not per specific object instance. It is possible to say "Mary may change news stories," but it's not currently possible to say "Mary may change news stories, but only the ones she created herself" or "Mary may only change news stories that have a certain status or publication date."