id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
28713	ModelBackend call to get_all_permissions() makes get_user_permissions() return all permissions	Yuri Kaszubowski Lopes	nobody	"django.contrib.auth.backends.ModelBackend.get_all_permissions() overwrites the _user_perm_cache as:


{{{
user_obj._perm_cache = self.get_user_permissions(user_obj)  # returns the set that is mutable
user_obj._perm_cache.update(self.get_group_permissions(user_obj))  # therefore, the set is changed here
}}}


An alternative solution would be:
{{{
user_obj._perm_cache = set()
user_obj._perm_cache.update(self.get_user_permissions(user_obj))
user_obj._perm_cache.update(self.get_group_permissions(user_obj))
}}}
"	Bug	closed	contrib.auth	dev	Normal	fixed			Unreviewed	1	0	0	0	0	0