如何防止 Django 管理员用户更改其他管理员用户个人资料数据？

发布于 2024-08-22 00:56:57 字数 79 浏览 2 评论 0原文

我有按教师类别扩展/子类化的管理员用户。

如何防止教师查看和更改其他教师的个人资料数据并且教师只能更改自己的记录/行？提前致谢！

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

梦中的蝴蝶 2024-08-29 00:56:57

我不确定我是否完全理解您想要做什么，但如果您的想法是让内置用户管理页面对教师用户的工作方式略有不同，那么我相信您只需扩展 UserAdmin，并重写queryset方法。

class TeacherSpecificUserAdmin(UserAdmin):
  def queryset(self, request):
    if request.user.is_teacher():
      return Teacher.objects.filter(pk=request.user.pk)
    return UserAdmin.queryset(self, request)

这将禁止教师编辑或删除其他记录，因为如果您查看 ModelAdmin 代码，change_view 和 delete_view 方法将使用从 queryset 方法返回的 queryset 来获取要更改或删除的对象。

还需要进行一项调整，因为用于更改 UserAdmin 中密码的视图不使用与其他视图相同的系统来更改对象。只需在您的新班级中覆盖它即可：

...
def user_change_password(self, request, id):
  if request.user.is_teacher() and request.user.pk != int(id):
    # PermissionDenied is in django.core.exceptions
    raise PermissionDenied
  return UserAdmin.user_change_password(self, request, id)
...

之后，您只需阻止教师添加新用户或删除他们自己的记录即可。使用默认的 django 的权限框架，或者覆盖 < code>has_add_permission 和 has_delete_permission 方法。

如果您需要更多信息，请查看 ModelAdmin 源代码（在 contrib/admin/options.py 中）。

I'm not sure I understand exactly what you're trying to do, but if what's in your mind is having the built-in user administration pages working slightly differently for Teacher users, then I believe you just have to extend UserAdmin, and override the queryset method.

class TeacherSpecificUserAdmin(UserAdmin):
  def queryset(self, request):
    if request.user.is_teacher():
      return Teacher.objects.filter(pk=request.user.pk)
    return UserAdmin.queryset(self, request)

That will take care of disallowing Teachers to edit or delete other records, because if you look in the ModelAdmin code, change_view and delete_view method use the queryset returned from queryset method to get the object to change or delete.

One more tweak is necessary, because the view used to change the password in UserAdmin doesn't use the same system as the others views to get the object to change. Just override it in your new class :

...
def user_change_password(self, request, id):
  if request.user.is_teacher() and request.user.pk != int(id):
    # PermissionDenied is in django.core.exceptions
    raise PermissionDenied
  return UserAdmin.user_change_password(self, request, id)
...

After that, you just have to prevent Teachers to add new users, or delete their own record. Do that either using the default django's permission framework, or by overriding has_add_permission and has_delete_permission methods.

Have a look in the ModelAdmin source code if you want more info (in contrib/admin/options.py).

回复收藏 0 原文