向用户公开 django admin。有害？
我正在开发一个有点像 Django 的电子商务项目，简单来说，我有一个客户模型和一个商家模型。 Merchant 模型与 MerchantStore 模型相关联，该模型在某种程度上“复杂”，与各种模型具有大量的 M2M 和外键关系。
按照此帖子中的解决方案进行操作，但没有足够的“时间”为了进行自定义实现，我决定让每个商家成为“stuff member”，并通过管理界面自定义他的商店。当然，我创建了一个具有适当权限的新组。
然而，出现了一些问题：
1）这被认为有害吗？是否存在任何相关的安全威胁？
2）如果你没有足够的时间，这不是最好的方法吗？
I am working on a Django somewhat e-commerce project, where, briefly, I have both a Customer and a Merchant model. The Merchant model is associated with a MerchantStore model which is somehow "complicated", having a plethora of m2m and foreign key relationships to various models.
Following the solution in this post and having not enough "time" to make a custom implementation, I decided to let each Merchant be a "stuff member" and customize his store through the admin interface. Of cource I created a new group with the appropriate permissions.
However, some questions arise:
1) Is this considered harmful? Are there any security threats associated?
2) Isn't this the best way to do it if you have not enough time anyway?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
不，我不认为这有害。
Apress 的 djangobook 中描述的“管理之禅”似乎暗示了将信任假设作为管理员“哲学”的一部分，并与经常重复的“管理不是你的应用程序”建议相结合，一开始我也很害怕，认为 Django 文档可以指出预期的、可行的用例。
请参阅我几乎相同的问题面向最终用户的Django AdminSite/ModelAdmin？
来自乔丹的回答（我给了他赏金）：
另请注意 Django 相对最新的安全更新 http://www.djangoproject.com/weblog /2010/dec/22/安全/
关于对象列表中的查询字符串参数。
这样的更新（引用：“有权访问管理员的攻击者[...]”）清楚地表明管理员对权限系统的实施正在受到不断的审查。
No, I would not consider this harmful.
The "Zen of Admin" as described in Apress's djangobook seemed to imply an assumption of trust as part of the admin's "philosophy", and paired with the often-repeated "admin is not your app" advice, I too was scared at first and think the Django documentation could point out intended, viable use cases.
Please see my almost identical question Django AdminSite/ModelAdmin for end users?
From Jordan's answer (who I gave the bounty):
Also note Django's relatively recent security update http://www.djangoproject.com/weblog/2010/dec/22/security/
regarding querystring parameters in object lists.
Such an update (quote: "an attacker with access to the admin [...]") is a clear indication that the admin's implementation of the permission system is being constantly scrutinized.
是的，这被认为是“有害的”，主要是由于 Django 开发人员的设计考虑。管理围绕“受信任的用户”的概念。换句话说，如果某人是工作人员（从而可以访问管理员），他们可能有足够的信任，不必担心安全漏洞。事实上，你可以阻止它们进入不应该干扰的部分（就像你所做的那样），但重点是 Django 在这方面不做任何保证。实际上，您可能不会遇到任何问题，但您可以。
讽刺的是，我认为我一生中花在自定义 Django 管理上的时间比我从头开始构建它所花费的时间还要多。有趣的是，事情是这样进行的。无论如何，我将其比作在 Ruby on Rails 中使用脚手架。这是让某些东西上线的快速方法，但目标是尽快替换它。
Yes, this is considered "harmful", mostly due to the design considerations of the Django developers. The admin revolves around a concept of "trusted users". In other words, if someone is a staff member (thereby having access to the admin), they presumably have enough of your trust to not be worried about security breaches. Now in truth, you could block them from portions they're not supposed to mess with (as you've done), but the point is that Django makes no guarantees in this area. You probably won't have any problems, in all actuality, but you could.
Ironically, I think I've spent more time in my life customizing the Django admin than it would have taken me to build it from scratch. Funny how that goes. Regardless, I'd liken it to using scaffolding in Ruby on Rails. It's a quick way to get something live, but the goal is to replace it as soon as possible.