Django is_staff 权限装饰器 [英] Django is_staff permission decorator

问题描述

我正在尝试使用 2 个用户级别来限制对页面的访问.超级用户和管理员.超级用户是分配了is_superuser"的普通 Django 用户.Admin 用户也是普通用户，只分配了is_staff"权限.

I am trying to limit access to pages using 2 user levels. Superuser and admin. Super user is a regular Django user with 'is_superuser' assigned. Admin user is also a regular user with only the 'is_staff' permission assigned.

问题是当我为管理员用户使用这个装饰器时，它没有通过测试:

The problem is that when i use this decorator for an admin user, it doesn't pass the test:

@permission_required('is_staff')
def my_view(....)

@permission_required('is_staff') 为匿名用户返回 false.(正确)
@permission_required('is_superuser') 仅对超级用户返回 true(正确)
@permission_required('is_staff') 为分配了 'is_staff' perm 的用户返回 FALSE.(错误).

@permission_required('is_staff') returns false for anonymous users. (correct)
@permission_required('is_superuser') only returns true for superusers (correct)
@permission_required('is_staff') returns FALSE for users with the 'is_staff' perm assigned. (wrong).

有什么想法吗?

推荐答案

is_staff 不是权限，因此您可以使用:

is_staff isn't a permission so instead of permission_required you could use:

@user_passes_test(lambda u: u.is_staff)

或

from django.contrib.admin.views.decorators import staff_member_required

@staff_member_required

这篇关于Django is_staff 权限装饰器的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！