django-permissions

I've got a model defined in my Django app foo which looks like this: class Bar(models.Model): class Meta: permissions = ( ("view_bar", "Can view bars"), ) I've run manage.py syncdb on this, and sure enough, it shows up in the auth_permissions table: id|name|content_type_id|codename 41|Can view bars|12|view_bar However, when I try adding that permission to a user object in a view, like so: request.user.user_permissions.add('foo.view_bar') The code blows up with the following exception: invalid literal for int() with base 10: 'foo.view_bar' What's going on? user_permissions.add is adding to a

I have following functions in rest API for User model. I want to set AllowAny permission on only POST request. Can someone help me out. class UserList(APIView): """Get and post users data.""" def get(self, request, format=None): """Get users.""" users = User.objects.all() serialized_users = UserSerializer(users, many=True) return Response(serialized_users.data) def post(self, request, format=None): """Post users.""" serializer = UserSerializer(data=request.data) if serializer.is_valid(): serializer.save() return Response(serializer.data, status=status.HTTP_201_CREATED) You can write a custom

How to check in template whether user belongs to some group? It is possible in a view which is generating the template but what if I want to check this in base.html which is an extending template (it does not have it's own view function)? All of my templates extends base.html so it is not good to check it in each view . The base.html contains upper bar, which should contain buttons depending on in which group logged user is (Customers, Sellers). In my base.html is: {% if user.is_authenticated %} which is not enough because I have to act differently to users from Customers and users from

I'm a newbie in developing with Django + Django Rest-framework and I'm working on a project that provides REST Api access. I was wondering what is the best practice to assign a different permission to each action of a given ApiView or Viewset. Let's suppose I defined some permissions classes such as 'IsAdmin', 'IsRole1', 'IsRole2', ..., and I want to grant different permissions to the single actions (e.g. a user with Role1 can create or retrieve, a user with Role2 can update, and only an Admin can delete). How can I structure a class based view in order to assign a permission class to the

I understand the basic user stuff. I know authentication, login, creating accounts, etc. But now I want to work on groups and permissions. Where is the documentation for django groups/permissions? This is not it: http://docs.djangoproject.com/en/dev/topics/auth/ Alex Kuhl I suppose the first question you need to ask are what permissions do you need and what sort. By what sort, I mean do you want Model- or Object-level. To clarify the difference say you have a model Car. If you want to give permissions on all cars, then Model-level is appropriate, but if you want to give permissions on a per

I wanted to add some groups and assign permissions to them in a manually written migration but if I run it on a clean DB it creates permissions only after running all migrations. I've found this ticket: https://code.djangoproject.com/ticket/23422 but I cannot comment there (it's possible I was banned after expressing some discontent with GeoDjango docs), so I'll share an improvement over the solution there below. In django 1.10 the following code could be used: from django.contrib.auth.management import create_permissions def migrate_permissions(apps, schema_editor): for app_config in apps.get

I've recently started using django to administer a large existing application that was grown organically over the years using twisted.web. I started experimenting with django and it's automatic admin interface and I've been very pleased with the results. One thing that seems to be missing for my purposes is the ability to give users read only access to data. For instance we have a role where people are allowed to login and create purchase orders. They also need to be able to view, but not edit other client or product data. How would I create "view" permissions in the django admin so users can