i am really new to Django, but since i am doing a fairly easy app i was suggested by a friend to use only the admin site which is fast and easy, i am almost done with my project, but i need one thing i don't seem to find anywhere.
My model is about adding programming problems, however i need to have a field that identifies which user added it and that only that user and the super users can erase or change the problem he just added.
Of course adding the field is quite simple, however how do i recognize who is adding the problem? and how to validate only him and the super users can change or delete that said problem?. I believe this is the most challenging phase of this project, can you help me?.
Thanks in advance :)!
EDIT: this is what i tried after the answer i just got recently, but i am quite stuck :/
EDIT2: this is now how it looks, but it gives my a type error and brings down the whole adminsite with this :
"has_change_permission() takes exactly 3 arguments (2 given)"
EDIT3: now i have changed the code but it still let regular staff users to erase delete entries, and sadly now it gives the error in EDIT 2 when i try to modify the content of the entry.
EDIT4: Finally thanks to your help i could make it impossible for a common user to delete directly on the database, however the default delete by queryset still works for them, what can i do?
EDIT5: Thanks for all the help you gave me today, now it works and it is wonderful! i leave the code so someone else with this same issue can just do it, i had to do such a long research to get rid of the "delete_element" from django's admin the one that is setted as default.
from django.contrib import admin
from .models import Problemas
# Register your models here.
from django.contrib.admin.actions import delete_selected as delete_selected_
def delete_selected(modeladmin,request,queryset):
for obj in queryset:
if (obj.User==request.user.username or request.user.is_superuser):
obj.delete()
class ProblemasAdmin(admin.ModelAdmin):
list_display = ('Juez', 'Nombre', 'Categoria','Dificultad','URL','User')
list_filter = ('Juez','Categoria','Dificultad','User')
search_fields = ['Nombre']
readonly_fields = ('User',)
list_per_page = 20
actions = [delete_selected]
def save_model(self, request, obj, form, change):
if (obj.User==""):
obj.User = request.user.username
obj.save()
def delete_model(self,request,obj):
for o in obj.all():
if (o.User==request.user.username or request.user.is_superuser):
o.delete()
def has_change_permission(self,request,obj=None):
return obj==None or request.user.username == obj.User or request.user.is_superuser
def has_delete_permission(self,request,obj=None):
return obj==None or request.user.username == obj.User or request.user.is_superuser
admin.site.register(Problemas,ProblemasAdmin)
#register(QuestionModel)
class QuestionModelAdmin(ModelAdmin):
def has_change_permission(self,request,obj=None):
return request.user == obj.owner
def has_delete_permission(self,request,obj=None):
return request.user == obj.owner
I think should work
Related
Bit of a strange one and wondering if anyone else here has come across this.
I have a standard DeleteView with the GET showing a confirmation page containing a form that posts to the delete view.
Whenever I click confirm nothing happens - the post to the view occurs and it redirects as intended, however the object is not deleted.
If I then perform the action a second time the object is deleted.
class MetricDeleteView(DeleteView):
template_name = "dashboard/administration/metric/delete.html"
button_title = "Update metric"
form_class = MetricUpdateForm
model = dashboard_metric
#cached_property
def dashboard_score(self):
return self.get_object().score
def get_success_url(self):
return reverse_lazy("administration:dashboard:update_score", kwargs={
'dashboard': self.dashboard_score.dashboard.id,
'pk': self.dashboard_score.id
})
I can't for the life of me figure out why this is occurring across all some models on my site.
Hm, interesting. As the view is generic, have you looked at the model to check it doesn't override the delete functionality? Perhaps it doesn't delete on the first pass and sets a variable to 'deleted' instead, especially if you're working with syncing across platforms. WatermelonDB, for instance. Nathan. :D
Have created a form but unsure if is right and also unable to add a user, it will show TypeError/
This is how the form I want it to look like
The following is my coding:
class Form_Add_User(forms.Form):
name=forms.CharField(label="Name", max_length=50)
dateofbirth=forms.DateField(label="Date of Birth", widget=forms.widgets.DateInput(format="%m/%d/%Y"))
contactnum=forms.CharField(label="Contact Number", max_length=9)
def adduser(request):
if len(request.POST)>0:
form=Form_Add_User(request.POST)
if(form.is_valid()):
name=form.cleaned_data['name']
dateofbirth=form.cleaned_data['dateofbirth']
contactnum=form.cleaned_data['contactnum']
new_user=User(name=name,dateofbirth=dateofbirth,contactnum=contactnum)
new_user.save()
return redirect('/adduser')
else:
return render(request,'adduser.html',{'form':form})
else:
form=Form_Add_User
return render(request,'adduser.html',{'form':form})
First off: it's always very useful to also post a full error message if you have one. The more info you give us, the easier (and quicker!) is answering your question.
I assume, your User model is not actually django's auth User model (see, if you had posted the model, I wouldn't have to guess).
The form you pass to your template was not instantiated:
#...
else:
form=Form_Add_User() #!!
return render(request,'adduser.html',{'form':form})
I couldn't find an answer to the following question, it took me a couple of hours to find out, hence I'm adding it. I'll add my approach of solving it and the answer.
I'm following a YouTube tutorial from This person. For some reason I'm typing the same code, and I checked every single letter. Yet for some reason my cleaning functions aren't called. It's probably something simple, especially since a related question showed something similar. It's probably a framework thing that I get wrong, but I wouldn't know what it is.
Here is the relevant code.
forms.py (complete copy/paste from his Github)
from django import forms
from .models import SignUp
class ContactForm(forms.Form):
full_name = forms.CharField(required=False)
email = forms.EmailField()
message = forms.CharField()
class SignUpForm(forms.ModelForm):
class Meta:
model = SignUp
fields = ['full_name', 'email']
### exclude = ['full_name']
def clean_email(self):
email = self.cleaned_data.get('email')
email_base, provider = email.split("#")
domain, extension = provider.split('.')
# if not domain == 'USC':
# raise forms.ValidationError("Please make sure you use your USC email.")
if not extension == "edu":
raise forms.ValidationError("Please use a valid .EDU email address")
return email
# Final part is ommited, since it's not relevant.
admin.py (typed over from the tutorial)
from django.contrib import admin
# Register your models here.
from .models import SignUp
from .forms import SignUpForm
class SignUpAdmin(admin.ModelAdmin):
list_display = ['__unicode__', 'timestamp', 'updated']
class Meta:
model = SignUp
form = SignUpForm
admin.site.register(SignUp, SignUpAdmin)
After using print statements for a while and reading questions that seemed similar but eventually didn't solve my problem, I decided to look into the source of Django (idea inspired by the most similar question I could find).
Then, I decided to debug the source, since I wanted to know how Django is treating my customized function (thanks to a tutorial + SO answer). In the source I found that the customized functions were called around return super(EmailField, self).clean(value) (line 585, django/forms/fields.py, Django 1.8). When I was stepping through the code I found the critical line if hasattr(self, 'clean_%s' % name): (line 409, django/forms/forms.py, Django 1.8). I checked for the value name which was "email". Yet, the if-statement evaluated as False ((Pdb) p hasattr(self, 'clean_%s' % name)). I didn't understand why, until I figured out that the function name was not registered ((Pdb) pp dir(self)).
I decided to take a look at the whole source code repository and cross-checked every file and then I found that
class Meta:
model = SignUp
form = SignUpForm
means that form / SignUpForm were nested inside the Meta class. At first, I didn't think much of it but slowly I started to realize that it should be outside the Meta class while staying main class (SignUpAdmin).
So form = SignUpForm should have been idented one tab back. For me, as a Django beginner, it still kind of baffles me, because I thought the Meta class was supposed to encapsulate both types of data (models and forms). Apparently it shouldn't, that's what I got wrong.
I try something with readonly field in Django 1.8.7, let say I have some code like the following:
class MyAdmin(admin.ModelAdmin):
readonly_fields = ('a', 'b')
def get_readonly_fields(self, request, obj=None):
if not request.user.is_superuser:
self.readonly_fields += ('c')
return super(MyAdmin, self).get_readonly_fields(request, obj)
first I login with super admin and access that admin page change_form,
the code is works well, then I login with staff user, then still works well, again, I try login with superadmin, but the read only fields rendered is for the non-superadmin user,
again I clear the browser cache, try again with super admin, but still not work correctly. I try restart the server, then it work normally until I repeat the same step above I do, this weird thing come again.
Anyone know why this happen ? I think this is looks like some bug but not sure.
Thanks in Advance.
The bug is not in Django, but in your code. In your get_readonly_fields method you modify the readonly_fields attribute; those modifications persist, since the admin object lives for the lifetime of the process.
Don't do that. get_readonly_fields is supposed to return a value, not modify the attribute. Just do:
def get_readonly_fields(self, request, obj=None):
rfo = super(MyAdmin, self).get_readonly_fields(request, obj)
if not request.user.is_superuser:
rfo += ('c')
return rfo
I'm new to the web development world, to Django, and to applications that require securing the URL from users that change the foo/bar/pk to access other user data.
Is there a way to prevent this? Or is there a built-in way to prevent this from happening in Django?
E.g.:
foo/bar/22 can be changed to foo/bar/14 and exposes past users data.
I have read the answers to several questions about this topic and I have had little luck in an answer that can clearly and coherently explain this and the approach to prevent this. I don't know a ton about this so I don't know how to word this question to investigate it properly. Please explain this to me like I'm 5.
There are a few ways you can achieve this:
If you have the concept of login, just restrict the URL to:
/foo/bar/
and in the code, user=request.user and display data only for the logged in user.
Another way would be:
/foo/bar/{{request.user.id}}/
and in the view:
def myview(request, id):
if id != request.user.id:
HttpResponseForbidden('You cannot view what is not yours') #Or however you want to handle this
You could even write a middleware that would redirect the user to their page /foo/bar/userid - or to the login page if not logged in.
I'd recommend using django-guardian if you'd like to control per-object access. Here's how it would look after configuring the settings and installing it (this is from django-guardian's docs):
>>> from django.contrib.auth.models import User
>>> boss = User.objects.create(username='Big Boss')
>>> joe = User.objects.create(username='joe')
>>> task = Task.objects.create(summary='Some job', content='', reported_by=boss)
>>> joe.has_perm('view_task', task)
False
If you'd prefer not to use an external library, there's also ways to do it in Django's views.
Here's how that might look:
from django.http import HttpResponseForbidden
from .models import Bar
def view_bar(request, pk):
bar = Bar.objects.get(pk=pk)
if not bar.user == request.user:
return HttpResponseForbidden("You can't view this Bar.")
# The rest of the view goes here...
Just check that the object retrieved by the primary key belongs to the requesting user. In the view this would be
if some_object.user == request.user:
...
This requires that the model representing the object has a reference to the User model.
In my project, for several models/tables, a user should only be able to see data that he/she entered, and not data that other users entered. For these models/tables, there is a user column.
In the list view, that is easy enough to implement, just filter the query set passed to the list view for model.user = loggged_id.user.
But for the detail/update/delete views, seeing the PK up there in the URL, it is conceivable that user could edit the PK in the URL and access another user's row/data.
I'm using Django's built in class based views.
The views with PK in the URL already have the LoginRequiredMixin, but that does not stop a user from changing the PK in the URL.
My solution: "Does Logged In User Own This Row Mixin"
(DoesLoggedInUserOwnThisRowMixin) -- override the get_object method and test there.
from django.core.exceptions import PermissionDenied
class DoesLoggedInUserOwnThisRowMixin(object):
def get_object(self):
'''only allow owner (or superuser) to access the table row'''
obj = super(DoesLoggedInUserOwnThisRowMixin, self).get_object()
if self.request.user.is_superuser:
pass
elif obj.iUser != self.request.user:
raise PermissionDenied(
"Permission Denied -- that's not your record!")
return obj
Voila!
Just put the mixin on the view class definition line after LoginRequiredMixin, and with a 403.html template that outputs the message, you are good to go.
In django, the currently logged in user is available in your views as the property user of the request object.
The idea is to filter your models by the logged in user first, and then if there are any results only show those results.
If the user is trying to access an object that doesn't belong to them, don't show the object.
One way to take care of all of that is to use the get_object_or_404 shortcut function, which will raise a 404 error if an object that matches the given parameters is not found.
Using this, we can just pass the primary key and the current logged in user to this method, if it returns an object, that means the primary key belongs to this user, otherwise it will return a 404 as if the page doesn't exist.
Its quite simple to plug it into your view:
from django.shortcuts import get_object_or_404, render
from .models import YourModel
def some_view(request, pk=None):
obj = get_object_or_404(YourModel, pk=pk, user=request.user)
return render(request, 'details.html', {'object': obj})
Now, if the user tries to access a link with a pk that doesn't belong to them, a 404 is raised.
You're going to want to look into user authentication and authorization, which are both supplied by [Django's Auth package] (https://docs.djangoproject.com/en/4.0/topics/auth/) . There's a big difference between the two things, as well.
Authentication is making sure someone is who they say they are. Think, logging in. You get someone to entire their user name and password to prove they are the owner of the account.
Authorization is making sure that someone is able to access what they are trying to access. So, a normal user for instance, won't be able to just switch PK's.
Authorization is well documented in the link I provided above. I'd start there and run through some of the sample code. Hopefully that answers your question. If not, hopefully it provides you with enough information to come back and ask a more specific question.
This is a recurring question and also implies a serious security flaw. My contribution is this:
There are 2 basic aspects to take care of.
The first is the view:
a) Take care to add a decorator to the function-based view (such as #login_required) or a mixin to the class-based function (such as LoginRequiredMixin). I find the official Django documentation quite helpful on this (https://docs.djangoproject.com/en/4.0/topics/auth/default/).
b) When, in your view, you define the data to be retrieved or inserted (GET or POST methods), the data of the user must be filtered by the ID of that user. Something like this:
def get(self, request, *args, **kwargs):
self.object = self.get_object(queryset=User.objects.filter(pk=self.request.user.id))
return super().get(request, *args, **kwargs)
The second aspect is the URL:
In the URL you should also limit the URL to the pk that was defined in the view. Something like this:
path('int:pk/blog-add/', AddBlogView.as_view(), name='blog-add'),
In my experience, this prevents that an user sees the data of another user, simply by changing a number in the URL.
Hope it helps.
In django CBV (class based views) you can prevent this by comparing the
user entered pk and the current logged in user:
Note: I tested it in django 4 and python 3.9.
from django.http import HttpResponseForbidden
class UserDetailView(LoginRequiredMixin, DetailView):
model = your_model
def dispatch(self, request, *args, **kwargs):
if kwargs.get('pk') != self.request.user.pk:
return HttpResponseForbidden(_('You do not have permission to view this page'))
return super().dispatch(request, *args, **kwargs)