esrg-knights / Squire

A re-introduction of the WebApp for ESRG Knights of the Kitchen Table.
https://www.kotkt.nl/
GNU General Public License v3.0
10 stars 8 forks source link

Django Admin module access check doesn't use custom backend #338

Open DutcherNL opened 11 months ago

DutcherNL commented 11 months ago

Display of access to specific modules on the Django admin panel doesn't seem to be checking for permissions, but uses a custom method has_module_perms ( @link) from the ModelBackend. Thus when no permission is set on either the user or the group object, the django admin visually denies access.

Solution: In the committees backend.py file add the missing method with the required logic

Edit: Check this source code to see how the Django auth module handles it and realise that a better way would be to use the permission cache on the user object while you are at it