From 9fcb7ae684265ee618a3570f97aff5e9868d550c Mon Sep 17 00:00:00 2001 From: "Jonathan S. Katz" Date: Sat, 28 Jan 2023 14:23:58 -0500 Subject: [PATCH] Allow admin manager of contributors to use user autocomplete This adds a permission check in the user admin view logic to allow someone administrating contributors to use the autocomplete functionality even if the user does not have permission to modify the users directly. --- pgweb/account/admin.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/pgweb/account/admin.py b/pgweb/account/admin.py index 7e0e747a..888405b5 100644 --- a/pgweb/account/admin.py +++ b/pgweb/account/admin.py @@ -132,6 +132,17 @@ class PGUserAdmin(UserAdmin): fs[1][1]['fields'] = list(fs[1][1]['fields']) + ['extraemail', ] return fs + def has_view_permission(self, request, obj=None): + """ + We have a special check for view permissions here based on if the user + has access to modifying contributors. This allows us to allow the + editor to return a list of usernames from the dropdown. If this is not + the autocomplete / user editor workflow, then we proceed as normal. + """ + if request.path == '/admin/autocomplete/' and request.GET.get('app_label') == 'contributors' and request.GET.get('model_name') == 'contributor' and request.user.has_perm("contributors.change_contributor"): + return True + return super().has_view_permission(request, obj) + @property def search_fields(self): sf = list(super().search_fields) -- 2.39.5