#11383: Admin action 'Delete selected' check only global model delete permission
-------------------------------------+-------------------------------------
Reporter: krejcik@… | Owner: (none)
Type: Bug | Status: new
Component: contrib.admin | Version: master
Severity: Normal | Resolution:
Keywords: delete permission | Triage Stage: Accepted
admin |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by adsworth):
What would the preferred UX be for this?
1. on POST, abort on the first object for which modeladmin.has_permission
returns `False`, with a message that the user doesn't have permission to
delete the obj.
2. on POST, iterate over all objects in the queryset and collect the ones
modeladmin.has_permission returns `False` for. If any can't be deleted
then abort the action with a list of records which couldn't be delete.
3. on POST, iterate over all objects in the queryset and only delete the
ones modeladmin.has_permission returns `True` for and add an the admin
message for the user stating that N objects were skipped.
4. on POST, iterate over all objects in the queryset and collect the ones
modeladmin.has_permission returns `False` for. If any can't be deleted
display them to the user and ask him if he want's to delete the other
ones.
5. on the confirm deletion page split the list in two parts. First part
lists the deletable objects, second part lists the non deletable objects.
Then on POST submit the deletable object IDs and only delete those.
If we start checking for object permissions here, this actually open the
whole box of how to handle the related objects. All the related objects
are already iterated using admin.utils.get_deleted_objects, but this only
calls user.has_perm
--
Ticket URL: <https://code.djangoproject.com/ticket/11383#comment:16>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/071.d1bec5e44607927874396c53669d2d85%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
