#6363: Bug with has_permission method of AdminSite class.
-------------------------------+------------------------------------------
Reporter: michelts | Owner: nobody
Type: Bug | Status: new
Component: contrib.admin | Version: newforms-admin
Severity: Normal | Resolution:
Keywords: nfa-someday | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 1 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+------------------------------------------
Comment (by claudep):
The visual quirk about user tools is gone. But there is still a small
difference in that the authentication simply refuse the login and
redisplay the login form without any explanation (like it would have given
if user is not staff or password is wrong).
Tentative resolution:
{{{
#!diff
diff --git a/django/contrib/admin/forms.py b/django/contrib/admin/forms.py
index 2e482b9..f40b2fc 100644
--- a/django/contrib/admin/forms.py
+++ b/django/contrib/admin/forms.py
@@ -17,7 +17,7 @@ class AdminAuthenticationForm(AuthenticationForm):
required_css_class = 'required'
def confirm_login_allowed(self, user):
- if not user.is_active or not user.is_staff:
+ if not self.request.admin_site.has_permission(self.request):
raise forms.ValidationError(
self.error_messages['invalid_login'],
code='invalid_login',
diff --git a/django/contrib/admin/sites.py b/django/contrib/admin/sites.py
index 4b5ee57..ff6767f 100644
--- a/django/contrib/admin/sites.py
+++ b/django/contrib/admin/sites.py
@@ -392,6 +392,7 @@ class AdminSite(object):
'authentication_form': self.login_form or
AdminAuthenticationForm,
'template_name': self.login_template or 'admin/login.html',
}
+ request.admin_site = self
return login(request, **defaults)
@never_cache
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/6363#comment:12>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/066.e9458b7d3831232cb759d771240564a5%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
