Update perms_map in DjangoModelPermissions and DjangoObjectPermissions #7719
Conversation
Django permissions allows for 'view_modelname'. When users have view_modelname permission, these permission classes don't recognize it and reject access to the user. My specific case was assigning customers to a group with the group having specific permissions allowed from the model permissions. Made this edit in an extension of DjangoModelPermissions to make it work. Thought it would be useful to have inherently.
|
+1 - it's actually really surprising that the defaults don't require view permissions for at least GET. |
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
There was a problem hiding this comment.
the defaults don't require view permissions for at least GET
The current code (without this PR) does look like a permission is not required by default when using Django-style permissions, so even users without the permission can GET the resource.
The contributor of this PR, @RashA07, says:
When users have view_modelname permission, these permission classes don't recognize it and reject access to the user.
This seems to be saying the opposite (nobody can access the resource, even with the permission).
- Did I get that right?
- If so, can you provide a reproducible example?
One form for a reproducible example would be a test (which would be required for merge anyway).
Once understood and confirmed, I think we can fix this in a major release.
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
Description
Django permissions allows for 'view_modelname'. When users have view_modelname permission, these permission classes don't recognize it and reject access to the user.
My specific case was assigning customers to a group with the group having specific permissions allowed from the model permissions. Made this edit in an extension of DjangoModelPermissions to make it work. Thought it would be useful to have inherently. Not sure if this solves an existing error of any sort.