Django - permissions and profiles

Question

I have a couple of different profiles. I want to associate permissions with these profiles. I've done so like this:

class StudentProfile(UserProfile):
    school = models.CharField(max_length=30)
    class Meta:
        permissions = (
            ("is_student","Can access student pages"),
        )

however, when I try and check if that permission exists using has_perm on that profile object, I get an error "'StudentProfile' object has no attribute 'has_perm'" am I not supposed to check for permissions in this way? I've read the docs and that's what I thought I was supposed to do

Edit: After reading the docs again, it seems that has_perm is a method belonging to Users and NOT their profiles. However, when I try to show the permissions:

print user.get_all_permissions()

I get an empty set. Shouldn't I see something like "appname.is_student"

score 4 · Accepted Answer · answered Jan 04 '11 at 18:58

4

.has_perm is a method on the User object, not on a UserProfile object. If you are trying to validate that a user has the permission has_student, you'd need to do something like this:

user.has_perm('profiles.is_student')

assuming that your StudentProfile model is in a profiles application.

EDIT: To address your rephrased question, you should assign permissions the normal way, either to the group or to a particular user, and use User.has_perm. Your latter example goes completely against the point of the Django permission system.

answered Jan 04 '11 at 18:58

Alex Vidal

4,080
20
23

Ok thanks. I'll try doing it the 'profiles.is_student' way and see if that works – JPC Jan 04 '11 at 19:07
It only assigns the permission if I do it through the admin tool when editing an individual user. When a user registers regularly, and the profile is attached, the permission defined in the meta class in the profile, doesn't get attached. print user.get_all_permissions() results in an empty set – JPC Jan 04 '11 at 19:18
@JPC: You'll need to either assign the user to the correct group that has the permission, or give the user the correct permission directly when they register. If you have your own form-handling code, you could do this after the user object is created: `user.permissions.add('profiles.is_student')`, or `user.groups.add('Student')` if the `Student` group has the `profiles.is_student` permission. – Alex Vidal Jan 04 '11 at 19:29
When I was using groups it worked fine. But it seems redundant to me to have to 1) define the permissions in the meta data of the profile 2) add those permissions to a group 3) add that user to a group. Why can't the user profile be a substitute for the group? What about something like user.permissions.add('profiles.permissions') or something so that it automatically adds all of the permissions from the profile – JPC Jan 04 '11 at 19:35
Something also to add, I think it should be user.user_permissions.add(), but when you do user.user_permissions.add('profiles.is_student'), it's expecting an int, not a string, so an error is thrown – JPC Jan 04 '11 at 20:19
@JPC: Ah, I was reading out of the [Django book](http://www.djangobook.com/en/2.0/chapter14/) which has `user.permissions.add`, where it should be `user.user_permissions`, and it expects a `Permission` object, not the codename for a permission. – Alex Vidal Jan 04 '11 at 21:08

Django - permissions and profiles

1 Answers1