has_add_permission() isn't working properly

[João Olavo Baião de Vasconcelos]

Hi there,

In admin.py, some ModelAdmin classes have the method has_add_permission(), which just returns False. This way, the "Add" button is removed from the admin interface for some models.

But such button stills appearing in the app page. I mean, when I'm at admin's Home page (http://mysite/myproject/admin), the button doesn't appear next to those models. The same thing in a model change page (http://mysite/myproject/admin/myapp/somemodel). But when I access http://mysite/myproject/admin/myapp, the "Add" button appears next to every model.

Is this a bug or an expected behavior? How can I also remove the Add button from the app page?

Thanks!
--
João Olavo Baião de Vasconcelos
Bacharel em Ciência da Computação
Analista de Sistemas - Infraestrutura
joaoolavo.wordpress.com

[João Olavo Baião de Vasconcelos]

2009/3/25 João Olavo Baião de Vasconcelos <joao...@gmail.com>

But such button stills appearing in the app page.

when I access http://mysite/myproject/admin/myapp, the "Add" button appears next to every model.

Just to complete the problem description: even with the "Add" button appearing in the app page, when I click to add a new object, the message "Permission denied" shows up. That is, although the button appears, the addition stills prohibited, which is the expected behavior.

[Karen Tracey]

2009/3/25 João Olavo Baião de Vasconcelos <joao...@gmail.com>

2009/3/25 João Olavo Baião de Vasconcelos <joao...@gmail.com>

But such button stills appearing in the app page.

when I access http://mysite/myproject/admin/myapp, the "Add" button appears next to every model.

Just to complete the problem description: even with the "Add" button appearing in the app page, when I click to add a new object, the message "Permission denied" shows up. That is, although the button appears, the addition stills prohibited, which is the expected behavior.

Probably a missed bit from when this was fixed for the other pages, see ticket #5447:

http://code.djangoproject.com/ticket/5447

In a quick look I don't see a ticket for this one, so if you get a chance it would be useful if you could write it up so it's not forgotten.

Karen

[João Olavo Baião de Vasconcelos]

On Wed, Mar 25, 2009 at 10:25 AM, Karen Tracey <kmtr...@gmail.com> wrote:

Probably a missed bit from when this was fixed for the other pages, see ticket #5447:

Thanks a lot, Karen. I opened a new ticket:
http://code.djangoproject.com/ticket/10624#preview (they said in #5447 to create a new one if an issue remains).
 

http://code.djangoproject.com/ticket/5447

In a quick look I don't see a ticket for this one, so if you get a chance it would be useful if you could write it up so it's not forgotten.

Karen

--

João Olavo Baião de Vasconcelos

[Alex Gaynor]

2009/3/25 João Olavo Baião de Vasconcelos <joao...@gmail.com>

I've closed this as a dupe of #9036, as you can see the issue is that the has_add_permission method isn't ever called.

Alex

--
"I disapprove of what you say, but I will defend to the death your right to say it." --Voltaire
"The people's good is the highest law."--Cicero

[Sergio A.]

the issue seems not to be totally solved by the patch.

If I have two classes A and B
class A has a field being a foreign key to a B class field
in the admin, when I add an A element, I see the '+' button on the
foreign key field to B even though I do not have the rights to create
a B element.
Therefore I see a pop-up with permission denied.

How to fix this?

Cheers, Sergio

On Mar 25, 7:14 pm, Alex Gaynor <alex.gay...@gmail.com> wrote:
> 2009/3/25 João Olavo Baião de Vasconcelos <joaool...@gmail.com>

>
>
>
> > On Wed, Mar 25, 2009 at 10:25 AM, Karen Tracey <kmtra...@gmail.com> wrote:
>
> >> Probably a missed bit from when this was fixed for the other pages, see
> >> ticket #5447:
>
> > Thanks a lot, Karen. I opened a new ticket:

> >http://code.djangoproject.com/ticket/10624#preview(they said in #5447 to

[Karen Tracey]

On Sun, May 17, 2009 at 5:34 PM, Sergio A. <sergio.a...@gmail.com> wrote:

the issue seems not to be totally solved by the patch.

If I have two classes A and B
class A has a field being a foreign key to a B class field
in the admin, when I add an A element, I see the '+' button on the
foreign key field to B even though I do not have the rights to create
a B element.
Therefore I see a pop-up with permission denied.

How to fix this?

That's a slightly different problem, and will need its own ticket.  Despite superficial similarity, hose "add another" links on the add/change pages for an object are coming from completely different code than the other problem mentioned in this thread.  Specifically, they are added by the RelatedFieldWidgetWrapper.  From a quick look I'm not sure this one is going to be easy to fix....I don't know that the widget wrapper has the necessary information to decide whether to include that link.  But you could open a ticket for someone to take a closer look.

Karen

[Alex Gaynor]

The widget doesn't really have the necessary info there.  Specfically it needs the logged in user (or at least the computed info about them), however it's not going to have that since there's no way for the render() method to get that since it's not a part of the forms library.  The best you could do is to pass it the widget constructor, which will be ok because of how we use the widgets in the admin, which will require a little bit of re-architecting.

[Sergio A.]

here it is: http://code.djangoproject.com/ticket/11136

hope this will be considered, since it improves the user experience.

Thanks for your feedback, Sergio



On May 18, 12:19 am, Alex Gaynor <alex.gay...@gmail.com> wrote:
> On Sun, May 17, 2009 at 5:15 PM, Karen Tracey <kmtra...@gmail.com> wrote: