Re: [Django] #15759: list_editable should respect per-object permissions

[Django]

#15759: list_editable should respect per-object permissions
-------------------------------+------------------------------------
Reporter: Jeremy Dunck | Owner: nobody
Type: Bug | Status: new
Component: contrib.admin | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+------------------------------------
Changes (by Asif Saifuddin Auvi):

* version: 1.3 => master

--
Ticket URL: <https://code.djangoproject.com/ticket/15759#comment:5>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#15759: list_editable should respect per-object permissions
-------------------------------+------------------------------------
Reporter: Jeremy Dunck | Owner: nobody
Type: Bug | Status: new

Component: contrib.admin | Version: dev

Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+------------------------------------

Changes (by Ülgen Sarıkavak):

* cc: Ülgen Sarıkavak (added)

--
Ticket URL: <https://code.djangoproject.com/ticket/15759#comment:6>

[Django]

#15759: list_editable should respect per-object permissions

-------------------------------+---------------------------------------
Reporter: Jeremy Dunck | Owner: mrartem1927
Type: Bug | Status: assigned

Component: contrib.admin | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

-------------------------------+---------------------------------------
Changes (by mrartem1927):

* owner: nobody => mrartem1927
* status: new => assigned

--
Ticket URL: <https://code.djangoproject.com/ticket/15759#comment:7>

[Django]

#15759: list_editable should respect per-object permissions
-------------------------------+---------------------------------------
Reporter: Jeremy Dunck | Owner: mrartem1927
Type: Bug | Status: assigned
Component: contrib.admin | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted

Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+---------------------------------------
Changes (by mrartem1927):

* has_patch: 0 => 1

Comment:

PR for this -> [https://github.com/django/django/pull/19743]
--
Ticket URL: <https://code.djangoproject.com/ticket/15759#comment:8>

[Django]

#15759: list_editable should respect per-object permissions

-------------------------------------+-------------------------------------
Reporter: Jeremy Dunck | Owner: Artyom
| Kotovskiy

Type: Bug | Status: assigned
Component: contrib.admin | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 1

Easy pickings: 0 | UI/UX: 0

-------------------------------------+-------------------------------------
Changes (by Jacob Walls):

* needs_better_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/15759#comment:9>

[Django]

#15759: list_editable should respect per-object permissions
-------------------------------------+-------------------------------------
Reporter: Jeremy Dunck | Owner: Artyom
| Kotovskiy
Type: Bug | Status: assigned
Component: contrib.admin | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Artyom Kotovskiy):

* needs_better_patch: 1 => 0

--
Ticket URL: <https://code.djangoproject.com/ticket/15759#comment:10>

[Django]

#15759: list_editable should respect per-object permissions
-------------------------------------+-------------------------------------
Reporter: Jeremy Dunck | Owner: Artyom
| Kotovskiy
Type: Bug | Status: assigned
Component: contrib.admin | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 1

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls):

* needs_better_patch: 0 => 1

Comment:

Would be good to have merge conflicts fixed before re-review.
--
Ticket URL: <https://code.djangoproject.com/ticket/15759#comment:11>

[Django]

#15759: list_editable should respect per-object permissions
-------------------------------------+-------------------------------------
Reporter: Jeremy Dunck | Owner: Artyom
| Kotovskiy
Type: Bug | Status: assigned
Component: contrib.admin | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Artyom Kotovskiy):

* needs_better_patch: 1 => 0

--
Ticket URL: <https://code.djangoproject.com/ticket/15759#comment:12>

[Django]

#15759: list_editable should respect per-object permissions
-------------------------------------+-------------------------------------
Reporter: Jeremy Dunck | Owner: Artyom
| Kotovskiy
Type: Bug | Status: assigned
Component: contrib.admin | Version: dev
Severity: Normal | Resolution:

Keywords: | Triage Stage: Ready for
| checkin

Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls):

* stage: Accepted => Ready for checkin

--
Ticket URL: <https://code.djangoproject.com/ticket/15759#comment:13>

[Django]

#15759: list_editable should respect per-object permissions
-------------------------------------+-------------------------------------
Reporter: Jeremy Dunck | Owner: Artyom
| Kotovskiy

Type: Bug | Status: closed
Component: contrib.admin | Version: dev
Severity: Normal | Resolution: fixed

Keywords: | Triage Stage: Ready for
| checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls <jacobtylerwalls@…>):

* resolution: => fixed
* status: assigned => closed

Comment:

In [changeset:"84db026228413dda4cd195464554d51c0b208e32" 84db026]:
{{{#!CommitTicketReference repository=""
revision="84db026228413dda4cd195464554d51c0b208e32"
Fixed #15759 -- Excluded fields by per-object permissions for
ModelAdmin.list_editable.

Instead of going over all objects in a queryset and filtering
by user permissions, added skipping while saving the formset
so there is no need to refetch objects again.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/15759#comment:15>

[Django]

#15759: list_editable should respect per-object permissions
-------------------------------------+-------------------------------------
Reporter: Jeremy Dunck | Owner: Artyom
| Kotovskiy

Type: Bug | Status: assigned

Component: contrib.admin | Version: dev
Severity: Normal | Resolution:

Keywords: | Triage Stage: Ready for
| checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Jacob Walls <jacobtylerwalls@…>):

In [changeset:"512e348bb271878a1e4f1ab6ae187a22dd16222b" 512e348b]:
{{{#!CommitTicketReference repository=""
revision="512e348bb271878a1e4f1ab6ae187a22dd16222b"
Refs #15759 -- Factored out _save_formset() in ModelAdmin.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/15759#comment:14>

[Django]

#15759: list_editable should respect per-object permissions
-------------------------------------+-------------------------------------
Reporter: Jeremy Dunck | Owner: Artyom
| Kotovskiy

Type: Bug | Status: new

Component: contrib.admin | Version: dev
Severity: Normal | Resolution:

Keywords: | Triage Stage: Accepted

Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Tim Graham):

* resolution: fixed =>
* stage: Ready for checkin => Accepted
* status: closed => new

Comment:

[https://github.com/django/django/pull/21179 Follow up PR]
--
Ticket URL: <https://code.djangoproject.com/ticket/15759#comment:16>

[Django]

#15759: list_editable should respect per-object permissions
-------------------------------------+-------------------------------------
Reporter: Jeremy Dunck | Owner: Artyom
| Kotovskiy
Type: Bug | Status: new
Component: contrib.admin | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Jacob Walls <jacobtylerwalls@…>):

In [changeset:"5b3cfce51770f46c6dc100e9be7f199a37176762" 5b3cfce]:
{{{#!CommitTicketReference repository=""
revision="5b3cfce51770f46c6dc100e9be7f199a37176762"
Refs #15759 -- Fixed ModelAdmin.list_editable form submission for non-
editable instances.

Added formset that excludes objects for which
user has no permission for POST formset as well.

Fixed regression test: the test was not simulating
real behaviour properly. By providing full form
data for the post request we skipped the part
where the user was actually limited in permissions
and only modified some of the rows.

Improved tests by getting rid of obj.id % 2
approach for granting permissions per object
for users, since it is not the safest.
Instead granting permissions simply by 'alive'
parameter, which is simpler and more stable.

Bug in 84db026228413dda4cd195464554d51c0b208e32.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/15759#comment:17>

[Django]

#15759: list_editable should respect per-object permissions
-------------------------------------+-------------------------------------
Reporter: Jeremy Dunck | Owner: Artyom
| Kotovskiy

Type: Bug | Status: closed
Component: contrib.admin | Version: dev
Severity: Normal | Resolution: fixed

Keywords: | Triage Stage: Ready for
| checkin

Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls):

* resolution: => fixed

* stage: Accepted => Ready for checkin

* status: new => closed

--
Ticket URL: <https://code.djangoproject.com/ticket/15759#comment:18>