pombreda / django-grappelli

Automatically exported from code.google.com/p/django-grappelli
Other
0 stars 0 forks source link

grappelli views don't test for authentication #348

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
0. remain un-logged-in
1. visit SITE_URL/grappelli/lookup/related
2. obverse the page loads (with an error)
3. curse your potentially insecure existence

What is the expected output? What do you see instead?
Redirection to somewhere...

What version of the product are you using? On what operating system?
Grappelli 2.3.2 on Django Beta 1

Please provide any additional information below.
1. Add the following import to views/related.py:

from django.contrib.auth.decorators import user_passes_test

2. and decorate each function therein with:

@user_passes_test(lambda u: us.is_staff)

3. Profit!

Original issue reported on code.google.com by nlhepler on 20 Feb 2011 at 12:42

GoogleCodeExporter commented 9 years ago
D'oh, nevermind. I see now that grappelli does check if the user is logged in. 
My test environment had a not-yet-stale session..

My goof...

Please close.

Thanks

Original comment by nlhepler on 20 Feb 2011 at 12:45

GoogleCodeExporter commented 9 years ago

Original comment by sehmaschine on 20 Feb 2011 at 12:41