Opened 5 years ago

Last modified 4 years ago

#17905 assigned New feature

Admin documentation lists all models, even for users without access to certain applications

Reported by: chriscohoat Owned by: Grzegorz Szczepańczyk
Component: contrib.admindocs Version: 1.4-alpha-1
Severity: Normal Keywords:
Cc: Triage Stage: Accepted
Has patch: yes Needs documentation: no
Needs tests: yes Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

By default, the admin docs lists documentation for all models. Some users may not have access to models that are still listed in their entirety.

The easiest way to fix this was to check each model in the model index, and only add the model to the listing if a user has the correct permissions. I'm not sure if this is the correct way to go about this, but I'm submitting the patch for review.

Attachments (5)

admindocs_model_permissions.diff (666 bytes) - added by chriscohoat 5 years ago.
Check user permissions in the admindocs model index.
admindocs_model_permissions.2.diff (1.5 KB) - added by chriscohoat 5 years ago.
Updated patch to include model details view.
admindocs_model_permissions.3.diff (1.0 KB) - added by chriscohoat 5 years ago.
Removed unnecessary import of forbidden HttpResponse. Default action raises an Http404 so that model names cannot be guessed.
patch_17905.diff (712 bytes) - added by Rickard Zachrisson 4 years ago.
Refined patch to be more pythonic in code design.
patch_17905.2.diff (1.5 KB) - added by Rickard Zachrisson 4 years ago.
Added validation for direct access to models to which you have no access

Download all attachments as: .zip

Change History (14)

Changed 5 years ago by chriscohoat

Check user permissions in the admindocs model index.

Changed 5 years ago by chriscohoat

Updated patch to include model details view.

Changed 5 years ago by chriscohoat

Removed unnecessary import of forbidden HttpResponse. Default action raises an Http404 so that model names cannot be guessed.

comment:1 Changed 5 years ago by Jannis Leidel

Triage Stage: UnreviewedAccepted

Yeah, this seems sensible. The patch you attached seems to have been generated wrong though, in the wrong order.

comment:2 Changed 5 years ago by Jannis Leidel

Needs documentation: set
Patch needs improvement: set

Changed 4 years ago by Rickard Zachrisson

Attachment: patch_17905.diff added

Refined patch to be more pythonic in code design.

comment:3 Changed 4 years ago by Rickard Zachrisson

Owner: changed from nobody to Rickard Zachrisson

comment:4 Changed 4 years ago by Rickard Zachrisson

Patch needs improvement: unset

comment:5 Changed 4 years ago by Rickard Zachrisson

Patch needs improvement: set

Noticed that it's possible to direct access models.

Changed 4 years ago by Rickard Zachrisson

Attachment: patch_17905.2.diff added

Added validation for direct access to models to which you have no access

comment:6 Changed 4 years ago by Rickard Zachrisson

Patch needs improvement: unset

comment:7 Changed 4 years ago by Rickard Zachrisson

Needs documentation: unset

Added documentation and added to pull request: https://github.com/django/django/pull/534

comment:8 Changed 4 years ago by Claude Paroz

Needs tests: set

comment:9 Changed 4 years ago by Grzegorz Szczepańczyk

Owner: changed from Rickard Zachrisson to Grzegorz Szczepańczyk
Status: newassigned
Note: See TracTickets for help on using tickets.
Back to Top