Skip to content

Fixed #25656 -- Removed link from recent actions when user has no perms.#21169

Open
artirix1927 wants to merge 1 commit intodjango:mainfrom
artirix1927:ticket_25656
Open

Fixed #25656 -- Removed link from recent actions when user has no perms.#21169
artirix1927 wants to merge 1 commit intodjango:mainfrom
artirix1927:ticket_25656

Conversation

@artirix1927
Copy link
Copy Markdown
Contributor

@artirix1927 artirix1927 commented Apr 25, 2026

Trac ticket number

ticket-25656

Branch description

Added jinja filter that checks per obj (recent activity entry) if user has permissions to edit the object.
In html file substitute the link with span
(that looks exactly like the link) in cases
where user doesn't have neccessary permissions.

Added tooltip for span that tells the user about
lack of permissions.
(Can be deleted if it needs consensus or looks like a bad idea for mergers but I thought its better to keep the same style for links and spans so the recent activites always look the same and to make them differ and more clear using tooltip on hover.)

Added regression test that makes sure that when user lacks permissions the link is changed with .

AI Assistance Disclosure (REQUIRED)

  • No AI tools were used in preparing this PR.
  • If AI tools were used, I have disclosed which ones, and fully reviewed and verified their output.
    ChatGpt 5.3 for tooltip css

Checklist

  • This PR follows the contribution guidelines.
  • This PR does not disclose a security vulnerability (see vulnerability reporting).
  • This PR targets the main branch.
  • The commit message is written in past tense, mentions the ticket number, and ends with a period (see guidelines).
  • I have not requested, and will not request, an automated AI review for this PR.
  • I have checked the "Has patch" ticket flag in the Trac system.
  • I have added or updated relevant tests.
  • I have added or updated relevant docs, including release notes if applicable.
  • I have attached screenshots in both light and dark modes for any UI changes.
Screenshot_1 Screenshot_2

@github-actions
Copy link
Copy Markdown

Thank you for your contribution to Django! This pull request has one or more items that need attention before it can be accepted for review.

🛑 Error: Missing PR Description

Your PR description must be substantive and meaningful. The placeholder text "Provide a concise overview of the issue or rationale behind the proposed changes." is not acceptable.

What to do:

Write a description that contains at least 5 words and addresses:

  • What problem does this PR solve?
  • Why is this change necessary?
  • What approach did you take?

A meaningful description helps reviewers understand the intent of your change quickly and increases the likelihood that your PR will be reviewed promptly.

If you have questions about these requirements, please review the contributing guidelines or ask for help on the Django Forum.

@github-actions
Copy link
Copy Markdown

Thank you for your contribution to Django! This pull request has one or more items that need attention before it can be accepted for review.

🛑 Error: Missing PR Description

Your PR description must be substantive and meaningful. The placeholder text "Provide a concise overview of the issue or rationale behind the proposed changes." is not acceptable.

What to do:

Write a description that contains at least 5 words and addresses:

  • What problem does this PR solve?
  • Why is this change necessary?
  • What approach did you take?

A meaningful description helps reviewers understand the intent of your change quickly and increases the likelihood that your PR will be reviewed promptly.

If you have questions about these requirements, please review the contributing guidelines or ask for help on the Django Forum.

@artirix1927 artirix1927 reopened this Apr 25, 2026
@artirix1927 artirix1927 marked this pull request as draft April 26, 2026 00:50
@artirix1927 artirix1927 force-pushed the ticket_25656 branch 2 times, most recently from e329f04 to c5a43c4 Compare April 26, 2026 21:52
Added jinja simple tag that checks each recent activity entry
object if user has permissions to edit it
(also takes in account per object permissions from
model admin).
In html file substitute the link with span
(that looks exactly like the link) in cases
where user doesn't have neccessary permissions.

Added tooltip for span that tells the user about
lack of permissions.
(Can be deleted if it needs consensus or looks like
a bad idea for mergers but I thought its better to
keep the same style for links and spans so the recent
activites always look the same and to make them differ
and more clear using tooltip on hover.)

Added regression test that when user lacks
permissions makes sure the links are changed with <span>.
Added regression test that makes sure per object
permission are respected.
@artirix1927 artirix1927 marked this pull request as ready for review April 27, 2026 01:53
Copy link
Copy Markdown
Contributor

@eevelweezel eevelweezel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When I run my test project with your branch, I don't see the tooltip when I hover over an entry in "My actions" for which I lack view permissions.

Firefox ESR, dark mode, Debian 13

@artirix1927
Copy link
Copy Markdown
Contributor Author

artirix1927 commented Apr 30, 2026

When I run my test project with your branch, I don't see the tooltip when I hover over an entry in "My actions" for which I lack view permissions.

Firefox ESR, dark mode, Debian 13

The entry is not clickable though, or it is?
Do you have change permissions for the object? In my simple only accounted for change permissions since that's the page for the link was generated.
Do you not have global view permissions for the object or per object permissions?

@eevelweezel
Copy link
Copy Markdown
Contributor

When I run my test project with your branch, I don't see the tooltip when I hover over an entry in "My actions" for which I lack view permissions.

Firefox ESR, dark mode, Debian 13

The entry is not clickable though, or it is?
Do you have change permissions for the object? In my simple only accounted for change permissions since that's the page for the link was generated.
Do you not have global view permissions for the object or per object permissions?

I was using the example from the ticket, so I'm using a staff user with just add permissions on the object (no change or view). The entry was clickable, but it resulted in a 403.

@artirix1927
Copy link
Copy Markdown
Contributor Author

When I run my test project with your branch, I don't see the tooltip when I hover over an entry in "My actions" for which I lack view permissions.
Firefox ESR, dark mode, Debian 13

The entry is not clickable though, or it is?
Do you have change permissions for the object? In my simple only accounted for change permissions since that's the page for the link was generated.
Do you not have global view permissions for the object or per object permissions?

I was using the example from the ticket, so I'm using a staff user with just add permissions on the object (no change or view). The entry was clickable, but it resulted in a 403.

Well that's exactly the behavior before my fixes. Are you sure that the my branch is installed as django for the venv in your test project?

@eevelweezel
Copy link
Copy Markdown
Contributor

When I run my test project with your branch, I don't see the tooltip when I hover over an entry in "My actions" for which I lack view permissions.
Firefox ESR, dark mode, Debian 13

The entry is not clickable though, or it is?
Do you have change permissions for the object? In my simple only accounted for change permissions since that's the page for the link was generated.
Do you not have global view permissions for the object or per object permissions?

I was using the example from the ticket, so I'm using a staff user with just add permissions on the object (no change or view). The entry was clickable, but it resulted in a 403.

Well that's exactly the behavior before my fixes. Are you sure that the my branch is installed as django for the venv in your test project?

I was certain it was, but who knows. I deleted and recreated my venv, and now I see this. It's not a tooltip, but it's certainly working as expected (I'm guessing the difference is related to using Debian's packaged browser).
image

I've run the tests against main, and they fail as expected. LGTM!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants