python - Django 组和权限

Question

我想创建 2 个组(教授、学生)。我想限制学生创建和删除类(class)。

views.py:

def is_professor(function=None):

    def _is_professor(u):
      if user.groups.filter(name='Professor').exists():
          return True
      else:
          raise HttpResponseForbidden
  return _is_professor(function)

class ListCourseView(ListView):

    model = Course
    template_name = 'course_list.html'
    fields = '__all__'

@is_professor
class CreateCourseView(CreateView):

    def get_queryset(self, request):
        if not request.user.is_superuser:
             return False

    model = Course
    template_name = 'course/edit_course.html'
    fields = '__all__'

    def get_success_url(self):
        return reverse('courses-list')

    def get_context_data(self, **kwargs):

         context = super(CreateCourseView, self).get_context_data(**kwargs)
        context['action'] = reverse('courses-new')

        return context

class UpdateCourseView(UpdateView):

    model = Course
    template_name = 'course/edit_course.html'
    fields = '__all__'

    def get_success_url(self):
        return reverse('courses-list')

def get_context_data(self, **kwargs):

    context = super(UpdateCourseView, self).get_context_data(**kwargs)
    context['action'] = reverse('courses-edit',
                                kwargs={'pk': self.get_object().id})

    return context

class DeleteCourseView(DeleteView):

    model = Course
    template_name = 'course/delete_course.html'

    def get_success_url(self):
        return reverse('courses-list')

模型.py

 class Course(models.Model):
    name = models.CharField(
    max_length=255,
    )

    def __str__(self):
        return ' '.join([
        self.name
        ])



class UserProfile(models.Model):
    user = models.OneToOneField(User)

    picture = models.ImageField(upload_to='profile_images', blank=True)

    class Meta:
        permissions = ( ('add_course', 'Add course'), )

    def __unicode__(self):
        return self.user.username

这是我试过的。首先我得到一个错误

NameError: global name 'user' is not defined.

其次，我仍然认为这行不通:)

Answer 1

我为我的一个 django 项目做的事情是:

我定义了一个函数来检查权限以及用户是否已通过身份验证:

from django.contrib.auth.decorators import user_passes_test

def group_required(*group_names):
    """Requires user membership in at least one of the groups passed in."""
    def in_groups(u):
        if u.is_authenticated():
            if bool(u.groups.filter(name__in=group_names)) | u.is_superuser:
                return True
        return False

    return user_passes_test(in_groups, login_url='403')

然后我将这个函数作为装饰器传递给我的函数:

from whatever import group_required

@group_required('Professor')
def action_only_for_professor(request):
    # do things

@group_required('Student')
def action_only_for_student(request):
    # do other things

使用此方法，您可以像这样为您的函数声明多组:

@group_required('Professor', 'Student', 'Administrator', ...)

此技巧仅适用于您创建的方法。如果你想在类里面做同样的事情，我建议你检查 django-braces (e.q. http://django-braces.readthedocs.org/en/latest/index.html)。Django Braces 的工作方式如下:

from braces.views import GroupRequiredMixin

class CreateCourseView(CreateView, GroupRequiredMixin):
    group_required = u"Professor"

    def get_queryset(self, request):
        if not request.user.is_superuser:
             return False

    model = Course
    template_name = 'course/edit_course.html'
    fields = '__all__'

    def get_success_url(self):
        return reverse('courses-list')

    def get_context_data(self, **kwargs):

         context = super(CreateCourseView, self).get_context_data(**kwargs)
        context['action'] = reverse('courses-new')

        return context

如果你想在你的类中使用多个组权限，就这样做:

group_required = [u"Professor", u"Student", u"Administrator", etc...]

Django-braces 非常强大，可以检查您的类的权限，从某种意义上说，您可以检查用户是否已通过身份验证(使用 LoginRequiredMixin)、是否是匿名用户(AnonymousrequiredMixin)、是否是 super 用户(SuperuserRequiredMixin)、是否有权限(PermissionRequiredMixin)或多个权限(MultiplePermissionRequiredMixin)，以及越来越多的东西!您只需要使用您想要使用的适当混合继承您的类；)

希望它能有所帮助，并等待您回来:)