Django admin - handling permissions of many to many fields

user_6505916 0
Viewed 198

Let's say I have 2 models as follows. As there is a many to many relation between the models, django created the required table (clientreport) and the table's permissions can be set using django admin's group permission's tab. (see screenshot)django admin ss

class Report(models.Model):
    is_visible = models.BooleanField(default=False)
    clients = models.ManyToManyField(Client)


class Client(models.Model):
    name = models.CharField(max_length=32)

On django admin I granted change permissions to a specific user group (e.g. group_a) on Report model. I did NOT grant any permissions on clientreport model.

My desired output is, a group_a user can change is_visible field of any Report instance but could not change/delete client X reports (or clientreport).

However even if there is no actual table reference between Report and Client models, a group_a user can still edit client-reports from django admin panel. (see screenshot)ss 2

Is this really intended? If so, how can I get my desired goal?

django-admin django-models django python
1 Answers

If you need to restrict access to certain fields by certain rights, you can use the ModelAdmin.get_readonly_fields method.

Usage example:

class ReportAdmin(admin.ModelAdmin):
    ...
    def get_readonly_fields(self, request, obj = None):
        if request.user.groups.filter(name=groupname).exists():
            return ('field1', 'field2')
        else:
            return super().get_readonly_fields(request, obj)
user_68386310
Related