Opened 12 years ago

Last modified 11 years ago

#17905 assigned New feature

Admin documentation lists all models, even for users without access to certain applications

Reported by: chriscohoat Owned by: Grzegorz Szczepańczyk
Component: contrib.admindocs Version: 1.4-alpha-1
Severity: Normal Keywords:
Cc: Triage Stage: Accepted
Has patch: yes Needs documentation: no
Needs tests: yes Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

By default, the admin docs lists documentation for all models. Some users may not have access to models that are still listed in their entirety.

The easiest way to fix this was to check each model in the model index, and only add the model to the listing if a user has the correct permissions. I'm not sure if this is the correct way to go about this, but I'm submitting the patch for review.

Attachments (5)

admindocs_model_permissions.diff​ (666 bytes ) - added by chriscohoat 12 years ago.
Check user permissions in the admindocs model index.
admindocs_model_permissions.2.diff​ (1.5 KB ) - added by chriscohoat 12 years ago.
Updated patch to include model details view.
admindocs_model_permissions.3.diff​ (1.0 KB ) - added by chriscohoat 12 years ago.
Removed unnecessary import of forbidden HttpResponse. Default action raises an Http404 so that model names cannot be guessed.
patch_17905.diff​ (712 bytes ) - added by Rickard Zachrisson 11 years ago.
Refined patch to be more pythonic in code design.
patch_17905.2.diff​ (1.5 KB ) - added by Rickard Zachrisson 11 years ago.
Added validation for direct access to models to which you have no access

Download all attachments as: .zip

Change History (14)

by chriscohoat, 12 years ago

Attachment: admindocs_model_permissions.diff​ added

Check user permissions in the admindocs model index.

by chriscohoat, 12 years ago

Attachment: admindocs_model_permissions.2.diff​ added

Updated patch to include model details view.

by chriscohoat, 12 years ago

Attachment: admindocs_model_permissions.3.diff​ added

Removed unnecessary import of forbidden HttpResponse. Default action raises an Http404 so that model names cannot be guessed.

comment:1 by Jannis Leidel, 12 years ago

Triage Stage: Unreviewed → Accepted

Yeah, this seems sensible. The patch you attached seems to have been generated wrong though, in the wrong order.

comment:2 by Jannis Leidel, 12 years ago

Needs documentation: set
Patch needs improvement: set

by Rickard Zachrisson, 11 years ago

Attachment: patch_17905.diff​ added

Refined patch to be more pythonic in code design.

comment:3 by Rickard Zachrisson, 11 years ago

Owner: changed from nobody to Rickard Zachrisson

comment:4 by Rickard Zachrisson, 11 years ago

Patch needs improvement: unset

comment:5 by Rickard Zachrisson, 11 years ago

Patch needs improvement: set

Noticed that it's possible to direct access models.

by Rickard Zachrisson, 11 years ago

Attachment: patch_17905.2.diff​ added

Added validation for direct access to models to which you have no access

comment:6 by Rickard Zachrisson, 11 years ago

Patch needs improvement: unset

comment:7 by Rickard Zachrisson, 11 years ago

Needs documentation: unset

Added documentation and added to pull request: ​https://github.com/django/django/pull/534

comment:8 by Claude Paroz, 11 years ago

Needs tests: set

comment:9 by Grzegorz Szczepańczyk, 11 years ago

Owner: changed from Rickard Zachrisson to Grzegorz Szczepańczyk
Status: new → assigned
Note: See TracTickets for help on using tickets.
Back to Top