#24567: /admin/auth/user/add/ requires "auth | user | Can change user"
permission
-------------------------------+--------------------------------------
Reporter: yoyoma | Owner: nobody
Type: Bug | Status: closed
Component: contrib.admin | Version: 1.8
Severity: Normal | Resolution: invalid
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------------------------
Changes (by timgraham):
* status: new => closed
* needs_docs: => 0
* resolution: => invalid
* needs_tests: => 0
* needs_better_patch: => 0
Comment:
This is expected behavior. Please see the
[https://docs.djangoproject.com/en/1.8/topics/auth/default/#id7 auth
documentation].
Also note: if you want a user account to be able to create users using
the Django admin site, you’ll need to give them permission to add users
and change users (i.e., the “Add user” and “Change user” permissions). If
an account has permission to add users but not to change them, that
account won’t be able to add users. Why? Because if you have permission to
add users, you have the power to create superusers, which can then, in
turn, change other users. So Django requires add and change permissions as
a slight security measure.
--
Ticket URL: <https://code.djangoproject.com/ticket/24567#comment:1>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/064.23dbe2a32afd70c385c0b495895720e5%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
