Hello,
I am having some trouble with user permissions. I've read the
documentation, but the built-in Permission object isn't behaving as I
expect. Any help would be appreciated.
I have a simple project containing one app. That app has one model,
which is as follows. The model should be irrelevant, but it's here for
the sake of completeness:
class Person(models.Model):
first_name = models.CharField(blank=True, maxlength=100)
second_name = models.CharField(blank=True, maxlength=100)
class Admin:
pass
When I run ./manage.py syncdb, I get the following output (sections
removed where not relevant to my question):
hostname:permtest jonathan$ ./manage.py syncdb
Creating table auth_message
Creating table auth_group
Creating table auth_user
Creating table auth_permission
Creating table django_content_type
Creating table django_session
Creating table django_site
Creating table django_admin_log
Creating table foo_person
You just installed Django's auth system, which means you don't have
any superusers defined.
Would you like to create one now? (yes/no): yes
Username (Leave blank to use 'jonathan'): jonathan
Superuser created successfully.
Installing index for auth.Message model
Installing index for auth.Permission model
Loading 'initial_data' fixtures...
Installing index for admin.LogEntry model
No fixtures found.
I then have one superuser called 'jonathan', who has permission to do
anything. A shell session:
>>> from django.contrib.auth.models import User
>>> u = User.objects.get(id=1)
>>> u
<User: jonathan>
>>> u.has_perm("person.add_person")
True
However, if I remove the 'superuser' status from that user, but assign
them all permissions (I simply click the 'choose all' button in
/admin/), the console session reports that this user has no
permissions, even though I can happily use /admin/ to, for example,
edit Person records:
>>> from django.contrib.auth.models import User
>>> u = User.objects.get(id=1)
>>> u
<User: jonathan>
>>> u.has_perm("person.add_person")
False
However, if I inspect the user object, all the permissions seem to be in place:
>>> from django.contrib.auth.models import User
>>> u = User.objects.get(id=1)
>>> u
<User: jonathan>
>>> permissions = u.user_permissions.all()
>>> len(permissons)
27
>>> permissions
[<Permission: auth | message | Can add message>, <Permission: auth |
message | Can change message>... (snipped)
All the permissions seem to be present for the user, but each time I
query a permission, regardless of what the user's capabilities are in
the admin console, False is always returned:
>>> u.has_perm("message.add_message")
False
>>> u.has_perm("session.add_session")
False
>>> u.has_perm("site.edit_session")
False
Am I simply interrogating a user object incorrectly, or have I
completely misunderstood how permissions work?
I'm expecting to be able to check if a user has permission to edit
data in a view just by doing something like
if u.has_perm("person.add_person"):
render_to_response("add_person.html")
else:
render_to_response("permission_denied.html")
FWIW, I'm using Django SVN on OSX, sqlite database.
Any help would be much appreciated, I spent the better part fo a day
trying to work this out :-)
--Jon
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Django users" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at
http://groups.google.com/group/django-users?hl=en
-~----------~----~----~----~------~----~------~--~---
