#25163: When a user doesn't have permission to an admin page, raise 404 instead
of
redirecting to login
--------------------------------------+------------------------------------
Reporter: adelton | Owner: kswiat
Type: Cleanup/optimization | Status: assigned
Component: contrib.admin | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------------+------------------------------------
Comment (by adelton):
Replying to [comment:4 timgraham]:
> I would expect a user to reach such a page only by typing in a URL
manually, ...
I'm not sure I agree here. The `/admin` link is really no secret and
projects are likely to have it shown all over the places, in the form of
"and by the way, if you think you are the admin, here's the link, don't
worry, we will ask for your credentials if you are currently not logged
in". And if the user is not currently logged in, that's exactly what
happens.
The problem starts when the user is logged in, just not as staff.
Yes, you can say that in that case the link to `/admin` shouldn't be
displayed at all but we have no way to enforce that in code that people
write, and besides, why should authenticated user see less than anonymous?
Or is the general recommendation to never place link to `/admin` anywhere?
--
Ticket URL: <https://code.djangoproject.com/ticket/25163#comment:6>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/065.5080a743ab70e5280e77ecdb3cda70f0%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
