#20218: Default authorization backend returns False when queried for object
level
permissions
------------------------------+----------------------------------------
Reporter: soren@… | Owner: Mehmet Dogan
Type: Bug | Status: assigned
Component: contrib.auth | Version: master
Severity: Normal | Resolution:
Keywords: auth | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------------+----------------------------------------
Comment (by Carlton Gibson):
As I [https://github.com/django/django/pull/10636#issuecomment-467902972
commented on the PR], I think this should be addressed with a
`ModelBackend` subclass **in django-guardian** that ignores the `obj`
parameter to checks, so that the "superset" behaviour is available.
Something like...
{{{
from django.contrib.auth.backends import ModelBackend
class ImpliedObjectPermissionsBackend(ModelBackend):
"""
Ignores `obj` parameter to permission checks to apply general
permissions
at object-level.
Use in place of `ModelBackend` in settings.AUTHENTICATION_BACKENDS
to avoid
the need to check permissions twice when using Guardian:
user.has_perm('foo.change_bar', obj=bar)
Rather than:
user.has_perm('foo.change_bar', obj=bar) or
user.has_perm('foo.change_bar')
...when using ModelBackend.
"""
def has_perm(self, user, perm, obj=None):
return super().has_perm(perm)
...
}}}
This would be a small and natural addition to django-guardian, where it's
totally out of place in django itself.
As such, as old as this ticket is, I'm inclined to close this as
`wontfix`.
--
Ticket URL: <https://code.djangoproject.com/ticket/20218#comment:24>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/075.2b56d29fb0ba3cf2b6d52c0726c2ab32%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
