#29918: Add support for checking object permissions in PermissionRequiredMixin
---------------------------------+--------------------------------------
Reporter: Tobias Bengfort | Owner: nobody
Type: New feature | Status: new
Component: contrib.auth | Version: 2.1
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Description changed by Tobias Bengfort:
Old description:
> As far as I understand, django's architecture supports object
> permissions, but external apps like django-rules or django-guardian are
> supposed to provide actual implementations. I think this approach is
> great. However, I believe that there are some key points where django
> core should provide more tooling so that the external apps can
> concentrate more on building the actual authentication backends.
>
> On such point is `PermissionRequiredMixin`. If you want to use object
> permissions, you have to either replace or extend it.
>
> A new method `get_permission_object()` could be added. This is what
> django-guardian does. However, in django core it should return `None` by
> default for backwards compatibility (In django-guardian it falls back to
> `get_object()`).
>
> I sent a mail (https://groups.google.com/forum/#!topic/django-
> developers/5vpc_DExhUw) in which I proposed this and some more changes to
> object permission support. Unfortunately, I did not get a response.
>
> A patch is available at https://github.com/django/django/pull/10600
New description:
As far as I understand, django's architecture supports object permissions,
but external apps like django-rules or django-guardian are supposed to
provide actual implementations. I think this approach is great. However, I
believe that there are some key points where django core should provide
more tooling so that the external apps can concentrate more on building
the actual authentication backends.
On such point is `PermissionRequiredMixin`. If you want to use object
permissions, you have to either replace or extend it.
A new method `get_permission_object()` could be added. This is what
django-guardian does. However, in django core it should return `None` by
default for backwards compatibility (In django-guardian it falls back to
`get_object()`).
I sent a mail (https://groups.google.com/forum/#!topic/django-
developers/5vpc_DExhUw) in which I proposed this and some more changes to
object permission support. Unfortunately, there was no response yet.
A patch is available at https://github.com/django/django/pull/10600
--
--
Ticket URL: <https://code.djangoproject.com/ticket/29918#comment:4>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/060.7d55e542cd44e4ffceeadf967c3b7c87%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
