Skip to content
This repository was archived by the owner on Jul 21, 2021. It is now read-only.
This repository was archived by the owner on Jul 21, 2021. It is now read-only.

Add configuration to return False if of obj is specifed but obj is None. #29

Open
@lambdalisue

Description

@lambdalisue

Currently when obj context is not exists in the template, something like {% if user has 'app_label.change_model' of obj %} return non object permission.

It is a correct behavior but usually non object permission should return True based on basic django concept (https://code.djangoproject.com/wiki/RowLevelPermissions) thus the following code will render links for chaning/deleting the object even if the accessed user does not have such permissions for the object.

{# assume if obj is None or context does not have obj #}
{% if user has 'foo.change_bar' of obj %}
<a href="{% url 'foo_bar_change' pk=obj.pk %}">Change</a>
{% endif %}
{% if user has 'foo.delete_bar' of obj %}
<a href="{% url 'foo_bar_delete' pk=obj.pk %}">Delete</a>
{% endif %}

It is quite annoying thus add PERMISSION_RETURN_FALSE_IF_NONE_IN_TEMPLATE or whatever configuration and check obj value at https://github.com/lambdalisue/django-permission/blob/master/src/permission/templatetags/permissionif.py#L38 and return False if of obj keyword is specified but obj is None.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions