Styjun

Break long word (not long text!) in longtable cell

Do people who work at research institutes consider themselves "academics"?

How would you translate "grit" (personality trait) to Chinese?

Formal Definition of Dot Product

Why did the soldiers of the North disobey Jon?

c++ conditional uni-directional iterator

Why is Drogon so much better in battle than Rhaegal and Viserion?

How to check if comma list is empty?

How to rename multiple files in a directory at the same time

How to not get blinded by an attack at dawn

Why does SSL Labs now consider CBC suites weak?

Can anyone give me examples of the relative-determinative 'which'?

How could it be that 80% of townspeople were farmers during the Edo period in Japan?

Capital gains on stocks sold to take initial investment off the table

Why is the Advance Variation considered strong vs the Caro-Kann but not vs the Scandinavian?

Why commonly or frequently used fonts sizes are even numbers like 10px, 12px, 16px, 24px, or 32px?

What was Varys trying to do at the beginning of S08E05?

Using chord iii in a chord progression (major key)

Why would someone open a Netflix account using my Gmail address?

Will there be more tax deductions if I put the house completely under my name, versus doing a joint ownership?

How will the lack of ground stations affect navigation?

How might a landlocked lake become a complete ecosystem?

Is random forest for regression a 'true' regression?

How to continually let my readers know what time it is in my story, in an organic way?

Why does `user.has_perm(Model, obj)` return False although `user.has_perm(Model)` returns True?

Save modelForm to update existing recordDjango: prevent logging permission errors from shellUnique email constraint for django.contrib.auth.userdjango admin inline delete without permissionDjango: New class added in model.py not showing in admin siteDjango Custom User Admin Loginhow to import an existing django project to pycharmCreating users in django (NOT NULL constraint failed: auth_user.last_login)GeoDjango distance query with srid 4326 returns 'SpatiaLite does not support distance queries on geometry fields with a geodetic coordinate system.'How to set dynamic initial values to django modelform field

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

0

In a Django project and application just created with django-admin startproject and ./manage.py startapp, I've created this model:

class Book(models.Model):
 author = models.CharField(max_length=50)

Then I run this code with ./manage.py shell:

from django.contrib.auth.models import Permission, User
from django.test import TestCase
from myapp.models import Book
myuser = User.objects.create_user(username="myuser")
myuser.user_permissions.add(Permission.objects.get(codename="change_book"))
mybook = Book(author="Joe Author")
mybook.save()
myuser.has_perm("myapp.change_book")) # The result is True
myuser.has_perm("myapp.change_book", mybook)) # The result is False

Why is this? The user does have permission to edit mybook, doesn't he? How is has_perm() supposed to work? Is this documented somewhere?

django django-authentication

share|improve this question

asked Mar 23 at 15:13

Antonis ChristofidesAntonis Christofides

3,6271832

add a comment | 

0

In a Django project and application just created with django-admin startproject and ./manage.py startapp, I've created this model:

class Book(models.Model):
 author = models.CharField(max_length=50)

Then I run this code with ./manage.py shell:

from django.contrib.auth.models import Permission, User
from django.test import TestCase
from myapp.models import Book
myuser = User.objects.create_user(username="myuser")
myuser.user_permissions.add(Permission.objects.get(codename="change_book"))
mybook = Book(author="Joe Author")
mybook.save()
myuser.has_perm("myapp.change_book")) # The result is True
myuser.has_perm("myapp.change_book", mybook)) # The result is False

Why is this? The user does have permission to edit mybook, doesn't he? How is has_perm() supposed to work? Is this documented somewhere?

django django-authentication

share|improve this question

asked Mar 23 at 15:13

Antonis ChristofidesAntonis Christofides

3,6271832

add a comment | 

In a Django project and application just created with django-admin startproject and ./manage.py startapp, I've created this model:

class Book(models.Model):
 author = models.CharField(max_length=50)

Then I run this code with ./manage.py shell:

from django.contrib.auth.models import Permission, User
from django.test import TestCase
from myapp.models import Book
myuser = User.objects.create_user(username="myuser")
myuser.user_permissions.add(Permission.objects.get(codename="change_book"))
mybook = Book(author="Joe Author")
mybook.save()
myuser.has_perm("myapp.change_book")) # The result is True
myuser.has_perm("myapp.change_book", mybook)) # The result is False

Why is this? The user does have permission to edit mybook, doesn't he? How is has_perm() supposed to work? Is this documented somewhere?

django django-authentication

share|improve this question

asked Mar 23 at 15:13

Antonis ChristofidesAntonis Christofides

3,6271832

class Book(models.Model):
 author = models.CharField(max_length=50)

from django.contrib.auth.models import Permission, User
from django.test import TestCase
from myapp.models import Book
myuser = User.objects.create_user(username="myuser")
myuser.user_permissions.add(Permission.objects.get(codename="change_book"))
mybook = Book(author="Joe Author")
mybook.save()
myuser.has_perm("myapp.change_book")) # The result is True
myuser.has_perm("myapp.change_book", mybook)) # The result is False

share|improve this question

asked Mar 23 at 15:13

Antonis ChristofidesAntonis Christofides

3,6271832

share|improve this question

asked Mar 23 at 15:13

Antonis ChristofidesAntonis Christofides

3,6271832

asked Mar 23 at 15:13

Antonis ChristofidesAntonis Christofides

3,6271832

asked Mar 23 at 15:13

Antonis ChristofidesAntonis Christofides

3,6271832

1 Answer
1

active

oldest

votes

1

The has_perm() API is designed to work with both model-level permissions (second parameter is None) and object-level permissions. It's up to individual authentication backends, however, to determine what to support.

In the case of Django's default ModelBackend there is no support for object-level permissions:

Django’s permission framework has a foundation for object permissions, though there is no implementation for it in the core. That means that checking for object permissions will always return False.

This is also noted in the ModelBackend documentation.

Note that the backend must return False here since the results from individual backends are, in essence, OR'ed together. If this backend returned True it wouldn't be possible to respect the finer-grained results from other backends.

And there are backends that implement object-level permissions, django-guardian being perhaps the best known. See how it documents has_perm():

Main difference between Django's ModelBackend is that we can pass obj instance here.

share|improve this answer

answered Mar 24 at 11:04

Kevin Christopher HenryKevin Christopher Henry

24.8k56964

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks. Is there any standard practice on how to interpret these permissions? For example, for a user to be able to edit an object, should he have both model-level AND object-level permissions? Or only one of these? Or only the second? The admin only supports model-level, and django-rules subclasses it to support object-level. I guess it's the app (such as django-rules or whatever we are developing) that decides how to interpret?
  
  – Antonis Christofides
  Mar 26 at 15:25
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @AntonisChristofides: Right, it really depends on the specific authentication backends and how they're designed to be used. It's not really a pluggable system, because you have to know what those rules are project-wide. For example, as you've seen, if you're calling has_perm() you have to know whether or not your project is using object-level permissions to know whether or not to pass the second argument.
  
  – Kevin Christopher Henry
  Mar 26 at 21:27
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55315181%2fwhy-does-user-has-permmodel-obj-return-false-although-user-has-permmodel%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

1

The has_perm() API is designed to work with both model-level permissions (second parameter is None) and object-level permissions. It's up to individual authentication backends, however, to determine what to support.

In the case of Django's default ModelBackend there is no support for object-level permissions:

Django’s permission framework has a foundation for object permissions, though there is no implementation for it in the core. That means that checking for object permissions will always return False.

This is also noted in the ModelBackend documentation.

Note that the backend must return False here since the results from individual backends are, in essence, OR'ed together. If this backend returned True it wouldn't be possible to respect the finer-grained results from other backends.

And there are backends that implement object-level permissions, django-guardian being perhaps the best known. See how it documents has_perm():

Main difference between Django's ModelBackend is that we can pass obj instance here.

share|improve this answer

answered Mar 24 at 11:04

Kevin Christopher HenryKevin Christopher Henry

24.8k56964

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks. Is there any standard practice on how to interpret these permissions? For example, for a user to be able to edit an object, should he have both model-level AND object-level permissions? Or only one of these? Or only the second? The admin only supports model-level, and django-rules subclasses it to support object-level. I guess it's the app (such as django-rules or whatever we are developing) that decides how to interpret?
  
  – Antonis Christofides
  Mar 26 at 15:25
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @AntonisChristofides: Right, it really depends on the specific authentication backends and how they're designed to be used. It's not really a pluggable system, because you have to know what those rules are project-wide. For example, as you've seen, if you're calling has_perm() you have to know whether or not your project is using object-level permissions to know whether or not to pass the second argument.
  
  – Kevin Christopher Henry
  Mar 26 at 21:27
  

  
  
  
  

add a comment | 

1

The has_perm() API is designed to work with both model-level permissions (second parameter is None) and object-level permissions. It's up to individual authentication backends, however, to determine what to support.

In the case of Django's default ModelBackend there is no support for object-level permissions:

Django’s permission framework has a foundation for object permissions, though there is no implementation for it in the core. That means that checking for object permissions will always return False.

This is also noted in the ModelBackend documentation.

Note that the backend must return False here since the results from individual backends are, in essence, OR'ed together. If this backend returned True it wouldn't be possible to respect the finer-grained results from other backends.

And there are backends that implement object-level permissions, django-guardian being perhaps the best known. See how it documents has_perm():

Main difference between Django's ModelBackend is that we can pass obj instance here.

share|improve this answer

answered Mar 24 at 11:04

Kevin Christopher HenryKevin Christopher Henry

24.8k56964

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks. Is there any standard practice on how to interpret these permissions? For example, for a user to be able to edit an object, should he have both model-level AND object-level permissions? Or only one of these? Or only the second? The admin only supports model-level, and django-rules subclasses it to support object-level. I guess it's the app (such as django-rules or whatever we are developing) that decides how to interpret?
  
  – Antonis Christofides
  Mar 26 at 15:25
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @AntonisChristofides: Right, it really depends on the specific authentication backends and how they're designed to be used. It's not really a pluggable system, because you have to know what those rules are project-wide. For example, as you've seen, if you're calling has_perm() you have to know whether or not your project is using object-level permissions to know whether or not to pass the second argument.
  
  – Kevin Christopher Henry
  Mar 26 at 21:27
  

  
  
  
  

add a comment | 

The has_perm() API is designed to work with both model-level permissions (second parameter is None) and object-level permissions. It's up to individual authentication backends, however, to determine what to support.

In the case of Django's default ModelBackend there is no support for object-level permissions:

Django’s permission framework has a foundation for object permissions, though there is no implementation for it in the core. That means that checking for object permissions will always return False.

This is also noted in the ModelBackend documentation.

Note that the backend must return False here since the results from individual backends are, in essence, OR'ed together. If this backend returned True it wouldn't be possible to respect the finer-grained results from other backends.

And there are backends that implement object-level permissions, django-guardian being perhaps the best known. See how it documents has_perm():

Main difference between Django's ModelBackend is that we can pass obj instance here.

share|improve this answer

answered Mar 24 at 11:04

Kevin Christopher HenryKevin Christopher Henry

24.8k56964

share|improve this answer

answered Mar 24 at 11:04

Kevin Christopher HenryKevin Christopher Henry

24.8k56964

answered Mar 24 at 11:04

Kevin Christopher HenryKevin Christopher Henry

24.8k56964

answered Mar 24 at 11:04

Kevin Christopher HenryKevin Christopher Henry

24.8k56964