mirrors/wagtail
mirrors/wagtail
0
0
Fork 0
mirror of https://github.com/wagtail/wagtail.git synced 2024-12-01 11:41:20 +01:00
Code Issues Releases Wiki Activity

Check add/change/delete permissions as appropriate within user admin UI

Browse Source 
...instead of using change_user for everything
This commit is contained in:
Matt Westcott 2015-08-13 15:41:19 +02:00
parent e1f4b9a68c
commit 45e3354a44
2 changed files with 22 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
wagtail/wagtailusers/views/users.py
View File

@ -8,19 +8,21 @@ from django.views.decorators.vary import vary_on_headers
from wagtail.wagtailadmin import messages
from wagtail.wagtailadmin.forms import SearchForm
from wagtail.wagtailadmin.utils import permission_required
from wagtail.wagtailadmin.utils import permission_required, any_permission_required
from wagtail.wagtailusers.forms import UserCreationForm, UserEditForm
from wagtail.wagtailcore.compat import AUTH_USER_APP_LABEL, AUTH_USER_MODEL_NAME
User = get_user_model()
# Typically we would check the permission 'auth.change_user' for user
# management actions, but this may vary according to the AUTH_USER_MODEL
# setting
# Typically we would check the permission 'auth.change_user' (and 'auth.add_user' /
# 'auth.delete_user') for user management actions, but this may vary according to
# the AUTH_USER_MODEL setting
add_user_perm = "{0}.add_{1}".format(AUTH_USER_APP_LABEL, AUTH_USER_MODEL_NAME.lower())
change_user_perm = "{0}.change_{1}".format(AUTH_USER_APP_LABEL, AUTH_USER_MODEL_NAME.lower())
delete_user_perm = "{0}.delete_{1}".format(AUTH_USER_APP_LABEL, AUTH_USER_MODEL_NAME.lower())
@permission_required(change_user_perm)
@any_permission_required(add_user_perm, change_user_perm, delete_user_perm)
@vary_on_headers('X-Requested-With')
def index(request):
q = None
@ -81,7 +83,7 @@ def index(request):
})
@permission_required(change_user_perm)
@permission_required(add_user_perm)
def create(request):
if request.POST:
form = UserCreationForm(request.POST)

15
wagtail/wagtailusers/wagtail_hooks.py
View File

@ -5,6 +5,7 @@ from django.contrib.contenttypes.models import ContentType
from django.utils.translation import ugettext_lazy as _
from wagtail.wagtailcore import hooks
from wagtail.wagtailcore.compat import AUTH_USER_APP_LABEL, AUTH_USER_MODEL_NAME
from wagtail.wagtailadmin.menu import MenuItem
from wagtail.wagtailusers.urls import users, groups
@ -18,9 +19,21 @@ def register_admin_urls():
]
# Typically we would check the permission 'auth.change_user' (and 'auth.add_user' /
# 'auth.delete_user') for user management actions, but this may vary according to
# the AUTH_USER_MODEL setting
add_user_perm = "{0}.add_{1}".format(AUTH_USER_APP_LABEL, AUTH_USER_MODEL_NAME.lower())
change_user_perm = "{0}.change_{1}".format(AUTH_USER_APP_LABEL, AUTH_USER_MODEL_NAME.lower())
delete_user_perm = "{0}.delete_{1}".format(AUTH_USER_APP_LABEL, AUTH_USER_MODEL_NAME.lower())
class UsersMenuItem(MenuItem):
def is_shown(self, request):
return request.user.has_module_perms('auth')
return (
request.user.has_perm(add_user_perm)
or request.user.has_perm(change_user_perm)
or request.user.has_perm(delete_user_perm)
)
@hooks.register('register_settings_menu_item')