search

AACEngineering / django-permissions-auditor

Tool to audit access control on your django app.
https://django-permissions-auditor.readthedocs.io/en/latest/
MIT License
20 stars 4 forks source link

django-oscar #6

Open jayvdb opened 3 years ago

jayvdb commented 3 years ago

https://github.com/django-oscar/django-oscar views are all marked as "login required" = red, when they should almost all be detected as login required.

kluchrj commented 3 years ago

I'm not very familiar with django-oscar, but it seems that they use their own permission system that does not leverage the stock Django mixins and decorators (which is the only system this project supports out of the box).

To detect oscar views correctly, you would need to write your own permissions processor.

From my quick glance at the oscar code, they use their own permissions_required decorator that calls django's user_passes_test function (see this class for an example of how permissions auditor processes that).