为什么Django没有查看权限?
问题描述:
我有一个活跃的Django项目,客户支持团队使用管理面板。 Django缺少view
权限,因此我必须将更改权限分配给客户支持团队,这有点危险。由于安全问题,我有一些模型,客户支持团队只需要查看访问权限而不需要更改访问权限。为什么在Django中缺少view
permision?任何解决方法呢?为什么Django没有查看权限?
答
我认为这应该工作:
1.新增 “查看” 的权限,请参阅https://*.com/a/23411901/1266258
2.Customize “变” 权限:
class FooAdmin(ModelAdmin):
def has_change_permission(self, request, obj=None):
# user can view the change list
if not obj and request.user.has_perm('myapp.view_foo'):
return True
# user can view the change form and change the obj
return request.user.has_perm('myapp.change_foo')
答
这里有一个解决方法。
模式
由混入继承他们只需创建视图的权限模型:
class ViewPermissionsMixin(models.Model):
"""
Mixin adds view permission to model.
"""
class Meta:
abstract=True
default_permissions = ('add', 'change', 'delete', 'view')
实例模型:
class ExampleModel(ViewPermissionsMixin):
name = models.CharField(max_length=255)
class Meta(ViewPermissionsMixin.Meta):
abstract = False
这将增加可分配给视图的权限某个用户/组。但是,如果没有适当的管理员修改,这种许可就没用
管理员
这里被混入你的管理员:
class AdminViewMixin(admin.ModelAdmin):
def has_perm(self,user,permission):
"""
Usefull shortcut for `user.has_perm()`
"""
if user.has_perm("%s.%s_%s" % (self.model._meta.app_label,permission,self.model.__name__.lower(),)):
return True
return False
def has_module_permission(self, request): # Django 1.8
pass
def has_change_permission(self, request, obj=None):
"""
Necessary permission check to let Django show change_form for `view` permissions
"""
if request.user.is_superuser:
return True
elif self.has_perm(request.user,'change'):
return True
elif self.has_perm(request.user,'view'):
return True
return super(AdminMixin, self).has_change_permission(request, obj)
def get_readonly_fields(self, request, obj=None):
"""
Turn each model field into read-only for `viewers`
"""
all_model_fields = []
for field in self.model._meta.fields:
# TODO in Django 1.8 use ModelAdmin.get_fields()
if not field.auto_created \
and (not hasattr(field,'auto_now_add') or not field.auto_now_add) \
and (not hasattr(field,'auto_now') or not field.auto_now) \
:
all_model_fields.append(field.name)
if request.user.is_superuser:
return self.readonly_fields
elif self.has_perm(request.user,'change'):
return self.readonly_fields
elif self.has_perm(request.user,'view'):
return all_model_fields
return self.readonly_fields
def change_view(self, request, object_id, extra_context=None):
"""
Disable buttons for `viewers` in `change_view`
"""
if request.user.is_superuser:
pass
elif self.has_perm(request.user,'change'):
pass
elif self.has_perm(request.user,'view'):
extra_context = extra_context or {}
extra_context['hide_save_buttons'] = True
return super(AdminViewMixin, self).change_view(request, object_id, extra_context=extra_context)
实例管理:
@admin.register(models.ExampleModel)
class ExampleAdmin(AdminViewMixin):
list_display = ('name',)
pass
最后只是为其分配特定车型中的任何用户或组view
许可,您Django Admin。
你的意思是你想让管理员只读信息? –
@marksweb:是的,但仅限于特定用户组。我不想让它只在全球范围内阅读。 – anon
没有人回答这个问题,为什么'view'权限丢失。 – mehmet