#25281: Permission strings don't uniquely identify permissions
------------------------------+--------------------
Reporter: ppiet | Owner: nobody
Type: Bug | Status: new
Component: contrib.auth | Version: master
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
------------------------------+--------------------
APIs related to permissions (e.g. User.has_perm()) take a 'permission
string' argument of format "<app label>.<permission codename>" to refer to
Permissions.
But each permission is uniquely defined on the model level as a tuple of
(content type, permission name). As content type refers to concrete model
within a concrete app, we should be using permission string of the format
"<app label>.<model name>.<permission codename>".
This becomes a concrete issue once one wants to define custom permissions
for their models, and doesn't observe the convention of putting the model
name in the permission codenames (or wants to inherit the custom
permissions form an abstract model).
See also https://groups.google.com/forum/#!searchin/django-
developers/permissions/django-developers/ngV5KhLXUrQ/DTfqhG0LRG4J .
--
Ticket URL: <https://code.djangoproject.com/ticket/25281>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/048.9259424b48860d7345cae201e92211a6%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
