Skip to content
Snippets Groups Projects
Commit d116202c authored by Tanner Prestegard's avatar Tanner Prestegard Committed by GraceDB
Browse files

Created new backend for model permissions

New auth backend for permissions. Basic ModelBackend returns false
if user has table-level permissions, but an object is passed in.
This new backend establishes that if the user has table-level
permissions, those supersede the lack of row-level permissions on
a given object.
parent 34f8c179
No related branches found
No related tags found
1 merge request!8Superevents
#from guardian import backends
from django.contrib.auth import backends
class ModelPermissionsForObjectBackend(backends.ModelBackend):
"""
Establishes a hierarchy for permissions: model/table-level
permissions are accepted in lieu of object/row-level permissions.
"""
def has_perm(self, user_obj, perm, obj=None):
# If an object is passed, Django's ModelBackend returns set() as the
# user's permissions. Otherwise, it returns the actual set of
# permissions that the user has. So we just run the check with obj set
# to None. This change just adjusts the logic:
# Previously, it was:
# No object: check for table-level permissions
# With object: return False
# Now, logic is: check for table-level permissions in either case
return super(ModelPermissionsForObjectBackend, self).has_perm(user_obj,
perm, obj=None)
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment