#29012: Coordination of Authorization Backends in Permission Checking
-----------------------------------------+------------------------
Reporter: Mehmet Dogan | Owner: nobody
Type: Uncategorized | Status: new
Component: contrib.auth | Version: 2.0
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-----------------------------------------+------------------------
Long story here: https://github.com/django-guardian/django-
guardian/issues/49
Short story: for authorization backends checking object level permissions
(like guardian) usually requires calling the django's default
authorization backend as a fallback to the more general set of
permissions:
{{{
if user.has_perm('foo.change_bar', obj=bar) and
user.has_perm('foo.change_bar'):
...
}}}
However, this not only looks ugly, but also requires polling of all the
backends twice, and thus, is a performance loss.
First, and possibly the best, solution to this is that, django does not
deny permission if obj argument is provided, but just ignores it. This way
by properly ordering backends in the settings, it could be a fallback
solution for the lower level checkers. This might be the move in the right
direction, although it is backwards incompatible.
A second solution is a keyword argument, such as fallback_to_model=False,
that will allow lower-level checkers mimic the model level permissions
that django does. Although this looks not DRY at first, it would give
other backends more control whether to fallback to django or not (in case
first solution is also accepted of course, otherwise, this is needed to
get the necessary permissions with one round of polling).
--
Ticket URL: <https://code.djangoproject.com/ticket/29012>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/051.cb2b7378004c7015bd380b9163b2fb91%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
