list_editable should respect per-object permissions
Currently, list_editable for admin displays form fields for all objects, even if an auth backend supports per-object permissions.
This allows editing of objects even if the user shouldn't be able to.
If there's a backend that supports per-object permissions, only those rows which allow editing should have edit fields.
I think this means that FormSet created in changelist_view needs to be passed a result_list which is annotated with per-object permission flags, and modelform_factory should respect those flags.
Change History
(10)
| Triage Stage: |
Unreviewed → Accepted
|
| Cc: |
Ülgen Sarıkavak added
|
| Owner: |
changed from nobody to Artyom Kotovskiy
|
| Status: |
new → assigned
|
| Patch needs improvement: |
set
|
| Patch needs improvement: |
unset
|
Yes, this makes a lot of sense. The trick will be to annotate the result list in a way that doesn't impact performance too much.