Skip to content
This repository has been archived by the owner on Jul 21, 2021. It is now read-only.

Add configuration to return False if of obj is specifed but obj is None. #29

Open
lambdalisue opened this issue Oct 23, 2014 · 0 comments

Comments

@lambdalisue
Copy link
Contributor

Currently when obj context is not exists in the template, something like {% if user has 'app_label.change_model' of obj %} return non object permission.

It is a correct behavior but usually non object permission should return True based on basic django concept (https://code.djangoproject.com/wiki/RowLevelPermissions) thus the following code will render links for chaning/deleting the object even if the accessed user does not have such permissions for the object.

{# assume if obj is None or context does not have obj #}
{% if user has 'foo.change_bar' of obj %}
<a href="{% url 'foo_bar_change' pk=obj.pk %}">Change</a>
{% endif %}
{% if user has 'foo.delete_bar' of obj %}
<a href="{% url 'foo_bar_delete' pk=obj.pk %}">Delete</a>
{% endif %}

It is quite annoying thus add PERMISSION_RETURN_FALSE_IF_NONE_IN_TEMPLATE or whatever configuration and check obj value at https://github.com/lambdalisue/django-permission/blob/master/src/permission/templatetags/permissionif.py#L38 and return False if of obj keyword is specified but obj is None.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

1 participant