#26392: Sample code for @permission_required is incorrect
-------------------------------+--------------------
Reporter: ebaumgartner | Owner: nobody
Type: Bug | Status: new
Component: Documentation | Version: 1.9
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------
The third code example in the following section is incorrect.
https://docs.djangoproject.com/en/1.9/topics/auth/default/#the-permission-
required-decorator
The example currently reads:
If you want to use raise_exception but also give your users a chance to
login first, you can add the login_required() decorator:
{{{
from django.contrib.auth.decorators import login_required,
permission_required
@permission_required('polls.can_vote', raise_exception=True)
@login_required
def my_view(request):
...
}}}
The decorators are in the wrong order. This should be:
{{{
from django.contrib.auth.decorators import login_required,
permission_required
@login_required
@permission_required('polls.can_vote', raise_exception=True)
def my_view(request):
...
}}}
Decorator order can be tested using three cases:
- User logged in with required permissions (view displays)
- User logged in with inadequate permissions (raise 403 exception)
- User not logged in (redirect to login page)
Currently the first two cases work as expected, but the third raises a 403
instead of allowing login. Reversing the order of the decorators makes all
three cases work as expected.
--
Ticket URL: <https://code.djangoproject.com/ticket/26392>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/055.7d321e10dbd5a03c9f631bb9cc1a78ce%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
