Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes permissions problem from proxy class #39

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Fixes permissions problem from proxy class #39

wants to merge 2 commits into from

Conversation

bee-keeper
Copy link
Contributor

Hello there,

Just been doing some testing and found the proxy FluentComment class is causing permission problems.

To replicate:

  • Create a group with all comment permissions
  • Add a user to the group
  • Login as above user and verify that you can't see the fluent_comments app in admin

The problem seems to stem from here (https://code.djangoproject.com/ticket/11154) and the fix below allows users with correct permissions to access the fluent-comments app.

I'm not completely convinced that the proxy needs to create it's own permissions but for now this at least fixes the issue.

Let me know what you think - sorry for breaking functionality with the proxy!

@bee-keeper
Copy link
Contributor Author

Actually, in addition to the above, you also need to make the following change in models.py (have updated the pull request with this change now). I'm not using threaded comments so not sure if this breaks functionality there and might need to be tested. I'd be happy to contribute some tests but I'm a bit pushed for time at the minute.

class FluentComment(Comment):
    """
    Proxy model to make sure that a ``select_related()`` is performed on the ``user`` field.
    """
    objects = FluentCommentManager()

    class Meta:
        proxy = True
        app_label = 'comments'

@vdboor
Copy link
Contributor

vdboor commented Apr 7, 2014

hmm thanks for reporting this issue!

The proxy model was supposed to be transparent, so this is a bummer for me. The given permission checks indeed break the threadedcomments, so this needs a slightly different approach (maybe even not using the proxy model in the first place)?

@bee-keeper
Copy link
Contributor Author

If it's possible to do away with the proxy that would be good, can definitely look into that approach. Alternatively, I think if the proxy just inherited the parent permissions we wouldn't have a problem either.

Have you tried simply removing the permissions in admin.py and keeping the app label? I believe that would work for threaded but it would render the proxy permissions redundant. However, might be the quickest fix for both fluent and threaded comments users?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants