forked from django-guardian/django-guardian
-
Notifications
You must be signed in to change notification settings - Fork 0
/
mixins.py
174 lines (131 loc) · 6.32 KB
/
mixins.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
from collections import Iterable
from django.conf import settings
from django.contrib.auth.decorators import REDIRECT_FIELD_NAME
from django.contrib.auth.decorators import login_required
from django.core.exceptions import ImproperlyConfigured
from django.core.exceptions import PermissionDenied
from guardian.utils import get_403_or_None
class LoginRequiredMixin(object):
"""
A login required mixin for use with class based views. This Class is a
light wrapper around the `login_required` decorator and hence function
parameters are just attributes defined on the class.
Due to parent class order traversal this mixin must be added as the left
most mixin of a view.
The mixin has exaclty the same flow as `login_required` decorator:
If the user isn't logged in, redirect to ``settings.LOGIN_URL``, passing
the current absolute path in the query string. Example:
``/accounts/login/?next=/polls/3/``.
If the user is logged in, execute the view normally. The view code is
free to assume the user is logged in.
**Class Settings**
``LoginRequiredMixin.redirect_field_name``
*Default*: ``'next'``
``LoginRequiredMixin.login_url``
*Default*: ``settings.LOGIN_URL``
"""
redirect_field_name = REDIRECT_FIELD_NAME
login_url = settings.LOGIN_URL
def dispatch(self, request, *args, **kwargs):
return login_required(redirect_field_name=self.redirect_field_name,
login_url=self.login_url)(
super(LoginRequiredMixin, self).dispatch
)(request, *args, **kwargs)
class PermissionRequiredMixin(object):
"""
A view mixin that verifies if the current logged in user has the specified
permission by wrapping the ``request.user.has_perm(..)`` method.
If a `get_object()` method is defined either manually or by including
another mixin (for example ``SingleObjectMixin``) or ``self.object`` is
defiend then the permission will be tested against that specific instance.
.. note:
Testing of a permission against a specific object instance requires an
authentication backend that supports. Please see ``django-guardian`` to
add object level permissions to your project.
The mixin does the following:
If the user isn't logged in, redirect to settings.LOGIN_URL, passing
the current absolute path in the query string. Example:
/accounts/login/?next=/polls/3/.
If the `raise_exception` is set to True than rather than redirect to
login page a `PermissionDenied` (403) is raised.
If the user is logged in, and passes the permission check than the view
is executed normally.
**Example Usage**::
class SecureView(PermissionRequiredMixin, View):
...
permission_required = 'auth.change_user'
...
**Class Settings**
``PermissionRequiredMixin.permission_required``
*Default*: ``None``, must be set to either a string or list of strings
in format: *<app_label>.<permission_codename>*.
``PermissionRequiredMixin.login_url``
*Default*: ``settings.LOGIN_URL``
``PermissionRequiredMixin.redirect_field_name``
*Default*: ``'next'``
``PermissionRequiredMixin.return_403``
*Default*: ``False``. Returns 403 error page instead of redirecting
user.
``PermissionRequiredMixin.raise_exception``
*Default*: ``False``
`permission_required` - the permission to check of form "<app_label>.<permission codename>"
i.e. 'polls.can_vote' for a permission on a model in the polls application.
"""
### default class view settings
login_url = settings.LOGIN_URL
permission_required = None
redirect_field_name = REDIRECT_FIELD_NAME
return_403 = False
raise_exception = False
def get_required_permissions(self, request=None):
"""
Returns list of permissions in format *<app_label>.<codename>* that
should be checked against *request.user* and *object*. By default, it
returns list from ``permission_required`` attribute.
:param request: Original request.
"""
if isinstance(self.permission_required, basestring):
perms = [self.permission_required]
elif isinstance(self.permission_required, Iterable):
perms = [p for p in self.permission_required]
else:
raise ImproperlyConfigured("'PermissionRequiredMixin' requires "
"'permission_required' attribute to be set to "
"'<app_label>.<permission codename>' but is set to '%s' instead"
% self.permission_required)
return perms
def check_permissions(self, request):
"""
Checks if *request.user* has all permissions returned by
*get_required_permissions* method.
:param request: Original request.
"""
obj = hasattr(self, 'get_object') and self.get_object() or getattr(self,
'object') or None
forbidden = get_403_or_None(request,
perms=self.get_required_permissions(request),
obj=obj,
login_url=self.login_url,
redirect_field_name=self.redirect_field_name,
return_403=self.return_403,
)
if forbidden:
self.on_permission_check_fail(request, forbidden, obj=obj)
if forbidden and self.raise_exception:
raise PermissionDenied()
return forbidden
def on_permission_check_fail(self, request, response, obj=None):
"""
Method called upon permission check fail. By default it does nothing and
should be overridden, if needed.
:param request: Original request
:param response: 403 response returned by *check_permissions* method.
:param obj: Object that was fetched from the view (using ``get_object``
method or ``object`` attribute, in that order).
"""
def dispatch(self, request, *args, **kwargs):
response = self.check_permissions(request)
if response:
return response
return super(PermissionRequiredMixin, self).dispatch(request, *args,
**kwargs)