#6363: Bug with has_permission method of AdminSite class.
-------------------------------+------------------------------------------
Reporter: michelts | Owner: nobody
Type: Bug | Status: new
Component: contrib.admin | Version: newforms-admin
Severity: Normal | Resolution:
Keywords: nfa-someday | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 1 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+------------------------------------------
Comment (by yakky):
@claudep proposed solution ''almost'' works, but request in
`confirm_login_allowed` still does not carry the **actual** user, but the
pre-login one (which is likely `AnonymousUser`).
A solution would be setting the user on request before passing to
`AdminSite.has_permission` (eventually resetting it to the original after
that).
Does it sound good?
{{{
#!diff
diff --git a/django/contrib/admin/forms.py b/django/contrib/admin/forms.py
index 2e482b9..e1d6fef 100644
--- a/django/contrib/admin/forms.py
+++ b/django/contrib/admin/forms.py
@@ -17,7 +17,8 @@ class AdminAuthenticationForm(AuthenticationForm):
required_css_class = 'required'
def confirm_login_allowed(self, user):
- if not user.is_active or not user.is_staff:
+ self.request.user = user
+ if not self.request.admin_site.has_permission(self.request):
raise forms.ValidationError(
self.error_messages['invalid_login'],
code='invalid_login',
}}}
rebasing @czpython PR it's also an option (and way cleaner as it will
display a proper message)
--
Ticket URL: <https://code.djangoproject.com/ticket/6363#comment:13>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/066.f16ba566a38c89b546759a22d3e609f8%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
