admin管理界面实现object权限

 

学习http://www.b-list.org/weblog/2008/dec/24/admin/后记录(部分翻译)

在django admin管理界面下,如何使用户只能看到与编辑他们自己创建的内容.

自动填写user

在一个weblog中,Entry model如下:

 

import datetime

from django.contrib.auth.models import User
from django.db import models


class Entry(models.Model):
    title = models.CharField(max_length=250)
    slug = models.SlugField()
    pub_date = models.DateTimeField(default=datetime.datetime.now)
    author = models.ForeignKey(User, related_name='entries')
    summary = models.TextField(blank=True)
    body = models.TextField()

    class Meta:
        get_latest_by = 'pub_date'
        ordering = ('-pub_date',)
        verbose_name_plural = 'entries'

    def __unicode__(self):
        return self.title

    def get_absolute_url(self):
        return "/weblog/%s/%s/" % (self.pub_date.strftime("%Y/%b/%d"),
                                   self.slug)

 

第一个目标是为Entry model实现一个ModelAdmin,在创建新的Entry时,自动填入当前用户到author字段中.在admin.py中:

 

from django.contrib import admin

from blog.models import Entry


class EntryAdmin(admin.ModelAdmin):
    exclude = ('author',)
    list_display = ('title', 'pub_date', 'author')
    prepopulated_fields = { 'slug': ['title'] }

    def save_model(self, request, obj, form, change):
        if not change:
            obj.author = request.user
        obj.save()
admin.site.register(Entry, EntryAdmin)

 

 

通过重载save_model来实现.save_model的参数:request:当前的HttpRequest;obj:准备要保存的对象;form:用于验证数据的form;change:表示该对象是第一次保存还是编辑已存在的对象.只需在新建对象时需要保存写入author.

 

只显示自己创建的entries.

通过重载EntryAdmin的函数queryset来实现.代码如下:

  def queryset(self, request):

         return Entry.objects.filter(author=request.user)

      

但这样的话,连管理员也只能看到自己创建的entries了,所以这样是不完善的.作如下改进:

  def queryset(self, request):

        if request.user.is_superuser:
            return Entry.objects.all()
        return Entry.objects.filter(author=request.user)

   

上面所作的改进只对list view已作用.然而另一个函数has_change_permission是在单个对象编辑页面来调用的,确保用户是否有权限编辑对象.默认情况下,如用户有"change"权限的,这个函数返回True.所以得去重载这个函数,体现正确的权限.

  def has_change_permission(self, request, obj=None):

        has_class_permission = super(EntryAdmin, self).has_change_permission(request, obj)
        if not has_class_permission:
            return False
        if obj is not None and not request.user.is_superuser and request.user.id != obj.author.id:
            return False
        return True

   

完整的代码如下:

 

from django.contrib import admin

from blog.models import Entry


class EntryAdmin(admin.ModelAdmin):
    exclude = ('author',)
    list_display = ('title', 'pub_date', 'author')
    prepopulated_fields = { 'slug': ['title'] }

    def has_change_permission(self, request, obj=None):
        has_class_permission = super(EntryAdmin, self).has_change_permission(request, obj)
        if not has_class_permission:
            return False
        if obj is not None and not request.user.is_superuser and request.user.id != obj.author.id:
            return False
        return True

    def queryset(self, request):
        if request.user.is_superuser:
            return Entry.objects.all()
        return Entry.objects.filter(author=request.user)

    def save_model(self, request, obj, form, change):
        if not change:
            obj.author = request.user
        obj.save()


admin.site.register(Entry, EntryAdmin)