Custom permissions on proxy model no longer created

[Koen Biermans]

I have been using some specific permissions concerning the auth user model, so I created a proxy model on user like this:

class User(auth_models.User):
    class Meta:
        proxy = True
        permissions = (
            ("display_users", "May display users information"),
            ("edit_users", "May edit users information"),
        )

In 1.3 these custom permissions were created during syncdb (linked to the auth.User model).

Now I was testing my project with the 1.4 RC, and it turns out those permissions are no longer created.

This is caused by the refactor of the create_permissions code, which now uses get_for_models to determine the class to get the options for, but this returns the proxied class (auth.User), not the proxy class, so my custom permissions are not found and not created.

[Ramiro Morales]

The refactoring mentioned is r16963.

[Ramiro Morales]

Related tickets with pending conceptual/design decision: #11154, #17648 and #14492.

[Simon Charette]

Actually the fix provided in #17648 would fix #11154 and this ticket, #14492 is really about another issue.

[Claude Paroz]

Revert optimization of r16963

[Claude Paroz]

Unless #17648 is fixed (proxy models having their own distinct ContentType) and we are probably too late in the 1.4 cycle for such a change, reverting the optimization of r16963 is probably the safest move at this time.

[Aymeric Augustin]

In [17776]:

Reverted parts of r16963 to fix a regression on the creation of permissions on proxy models. Refs #17904. Thanks koenb for the report and claudep for the patch.

[Aymeric Augustin]

I'm leaving this ticket open so we remember to reactivate this optimization, once the situation with proxy models is improved.

[Simon Charette]

Now that #18399 is fixed, I created a ​pull request that brings back the get_for_models permission creation optimization while passing the test added in r17776. Note that this patch fixes #11154 at the same time so it includes an extra test.

[Tim Graham]

Pull request was closed indicating this needs docs.

[Tim Graham]

A newer ​pull request was closed as the submitter couldn't address the security concerns raised there. Someone else is welcome to follow up and try to address them.

[Arthur Rio]

I'm going to try to address the security concerns in a new ​pull request.

[Tim Graham]

This ticket is fixed but it was kept open to restore the optimization of f04af7080b12744c8f06fb8228ef683d556690d0 (using ContentType.objects.get_for_models()). ​PR 10381 doesn't restore the optimization although it's been linked to this ticket. I tried using get_for_models() in that patch, but it doesn't work anymore because create_permissions() now uses model states (which don't have custom methods). Here's the error:

  File "/home/tim/code/django/django/contrib/contenttypes/models.py", line 89, in get_for_models
    opts_models = needed_opts.pop(ct.model_class()._meta, [])
AttributeError: 'ContentType' object has no attribute 'model_class'

If someone wants to look at that optimization again, please open a new ticket.