Permalink
Browse files

Refs #29419, #8936 -- Removed change permission requirement for admin…

… actions.

Partially reverted 825f0be.
  • Loading branch information...
carltongibson authored and timgraham committed Jun 5, 2018
1 parent ae26e0a commit b30f9b131c9489b9d9f21c311ecb46d0aea91381
Showing with 1 addition and 23 deletions.
  1. +0 −7 django/contrib/admin/options.py
  2. +0 −3 docs/ref/contrib/admin/actions.txt
  3. +1 −13 tests/modeladmin/tests.py
@@ -861,9 +861,6 @@ def get_actions(self, request):
# want *any* actions enabled on this page.
if self.actions is None or IS_POPUP_VAR in request.GET:
return OrderedDict()
- # The change permission is required to use actions.
- if not self.has_change_permission(request):
- return OrderedDict()
actions = []
@@ -1692,8 +1689,6 @@ def changelist_view(self, request, extra_context=None):
# Actions with no confirmation
if (actions and request.method == 'POST' and
'index' in request.POST and '_save' not in request.POST):
- if not self.has_change_permission(request):
- raise PermissionDenied
if selected:
response = self.response_action(request, queryset=cl.get_queryset(request))
if response:
@@ -1710,8 +1705,6 @@ def changelist_view(self, request, extra_context=None):
if (actions and request.method == 'POST' and
helpers.ACTION_CHECKBOX_NAME in request.POST and
'index' not in request.POST and '_save' not in request.POST):
- if not self.has_change_permission(request):
- raise PermissionDenied
if selected:
response = self.response_action(request, queryset=cl.get_queryset(request))
if response:
@@ -340,9 +340,6 @@ Conditionally enabling or disabling actions
Finally, you can conditionally enable or disable actions on a per-request
(and hence per-user basis) by overriding :meth:`ModelAdmin.get_actions`.
- This doesn't return any actions if the user doesn't have the "change"
- permission for the model.
-
This returns a dictionary of actions allowed. The keys are action names, and
the values are ``(function, name, short_description)`` tuples.
View
@@ -11,7 +11,7 @@
AdminDateWidget, AdminRadioSelect, AutocompleteSelect,
AutocompleteSelectMultiple,
)
-from django.contrib.auth.models import Permission, User
+from django.contrib.auth.models import User
from django.db import models
from django.forms.widgets import Select
from django.test import SimpleTestCase, TestCase
@@ -676,18 +676,6 @@ def test_get_deleted_objects(self):
self.assertEqual(perms_needed, set())
self.assertEqual(protected, [])
- def test_get_actions_requires_change_perm(self):
- user = User.objects.create_user(username='bob', email='bob@test.com', password='test')
- mock_request = MockRequest()
- mock_request.user = user
- mock_request.GET = {}
- ma = ModelAdmin(Band, self.site)
- self.assertEqual(list(ma.get_actions(mock_request).keys()), [])
- p = Permission.objects.get(codename='change_band', content_type=get_content_type_for_model(Band()))
- user.user_permissions.add(p)
- mock_request.user = User.objects.get(pk=user.pk)
- self.assertEqual(list(ma.get_actions(mock_request).keys()), ['delete_selected'])
-
class ModelAdminPermissionTests(SimpleTestCase):

0 comments on commit b30f9b1

Please sign in to comment.