[Django] #24567: /admin/auth/user/add/ requires "auth | user | Can change user" permission
Django
-------------------------------+--------------------
Reporter: yoyoma | Owner: nobody
Type: Bug | Status: new
Component: contrib.admin | Version: 1.8
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------
I'm getting a 403 when I visit the {{{ /admin/auth/user/add/ }}} with a
staff {{{User}}} that has only {{{auth | user | Can add user}}}
permission. After adding {{{auth | user | Can change user}}}, I'm able to
access the aforementioned URL without issue.
--
Ticket URL: <https://code.djangoproject.com/ticket/24567>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
Django
Reporter: yoyoma | Owner: nobody
Type: Bug | Status: closed
Component: contrib.admin | Version: 1.8
Severity: Normal | Resolution: invalid
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Changes (by timgraham):
* status: new => closed
* needs_docs: => 0
* resolution: => invalid
* needs_tests: => 0
* needs_better_patch: => 0
Comment:
This is expected behavior. Please see the
[https://docs.djangoproject.com/en/1.8/topics/auth/default/#id7 auth
documentation].
Also note: if you want a user account to be able to create users using
the Django admin site, you’ll need to give them permission to add users
and change users (i.e., the “Add user” and “Change user” permissions). If
an account has permission to add users but not to change them, that
account won’t be able to add users. Why? Because if you have permission to
add users, you have the power to create superusers, which can then, in
turn, change other users. So Django requires add and change permissions as
a slight security measure.
--
Ticket URL: <https://code.djangoproject.com/ticket/24567#comment:1>
Django
Reporter: yoyoma | Owner: nobody
Type: Bug | Status: closed
Component: contrib.admin | Version: 1.8
Severity: Normal | Resolution: invalid
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Easy pickings: 0 | UI/UX: 0
Comment (by yoyoma):
Ah, I see. Thanks for the explanation, @timgraham.
Because the User create form includes only username and password fields
(no permission and staff/superuser fields), I wonder if it's worth
exploring the option of changing this (e.g., user with only "can add User"
permission adds a User with a username and password, is redirected back to
the User list view).
--
Ticket URL: <https://code.djangoproject.com/ticket/24567#comment:2>
Django
Reporter: yoyoma | Owner: nobody
Type: Bug | Status: closed
Component: contrib.admin | Version: 1.8
Severity: Normal | Resolution: invalid
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Easy pickings: 0 | UI/UX: 0
Comment (by timgraham):
Maybe... I didn't research when that restriction was added to see if
things have changed since then.
--
Ticket URL: <https://code.djangoproject.com/ticket/24567#comment:3>