#29918: Add support for checking object permissions in PermissionRequiredMixin
-------------------------------------------+------------------------
Reporter: Tobias Bengfort | Owner: nobody
Type: New feature | Status: new
Component: contrib.auth | Version: 2.1
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 1
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------------+------------------------
As far as I understand, django's architecture supports object permissions,
but external apps like django-rules or django-guardian are supposed to
provide actual implementations. I think this approach is great. However, I
believe that there are some key points where django core should provide
more tooling so that the external apps can concentrate more on building
the actual authentication backends.
On such point is `PermissionRequiredMixin`. If you want to use object
permissions, you have to either replace or extend it.
A new method `get_permission_object()` could be added. This is what
django-guardian does. However, in django core it should return `None` by
default for backwards compatibility (In django-guardian it falls back to
`get_object()`).
A patch is available at https://github.com/django/django/pull/10600
--
Ticket URL: <https://code.djangoproject.com/ticket/29918>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/045.65f15953eee4c4cbbc05df0918b2695b%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
