{"action":"created","issue":{"url":"https://api.github.com/repos/lambdalisue/django-inspectional-registration/issues/36","labels_url":"https://api.github.com/repos/lambdalisue/django-inspectional-registration/issues/36/labels{/name}","comments_url":"https://api.github.com/repos/lambdalisue/django-inspectional-registration/issues/36/comments","events_url":"https://api.github.com/repos/lambdalisue/django-inspectional-registration/issues/36/events","html_url":"https://github.com/lambdalisue/django-inspectional-registration/issues/36","id":81613715,"number":36,"title":"Permissions bug prevents non-superusers from accepting/rejecting/activating registrations","user":{"login":"coredumperror","id":413571,"avatar_url":"https://avatars.githubusercontent.com/u/413571?v=3","gravatar_id":"","url":"https://api.github.com/users/coredumperror","html_url":"https://github.com/coredumperror","followers_url":"https://api.github.com/users/coredumperror/followers","following_url":"https://api.github.com/users/coredumperror/following{/other_user}","gists_url":"https://api.github.com/users/coredumperror/gists{/gist_id}","starred_url":"https://api.github.com/users/coredumperror/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coredumperror/subscriptions","organizations_url":"https://api.github.com/users/coredumperror/orgs","repos_url":"https://api.github.com/users/coredumperror/repos","events_url":"https://api.github.com/users/coredumperror/events{/privacy}","received_events_url":"https://api.github.com/users/coredumperror/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-05-27T20:36:41Z","updated_at":"2015-05-29T17:02:00Z","closed_at":"2015-05-28T02:32:59Z","body":"I have a Group called 'Admin', to which I have given every Registration related permission. However, my User, which is part of the Admin group, but not marked as a superuser, gets a PermissionDenied error whenever he tries to accept a user registration.\r\n\r\nI traced the code, and determined that this is the fault of the `RegistrationAdmin.has_accept_permission()` method. Because it passes `obj` into the call to `request.user.has_perm('registration.accept_registration', obj)`, Django's `django.contrib.auth.backends.ModelBackend` class automatically treats the user as having no permissions at all. Here are the relevant methods in `ModelBackend`:\r\n\r\n    def get_all_permissions(self, user_obj, obj=None):\r\n        if user_obj.is_anonymous() or obj is not None:\r\n            return set()\r\n        if not hasattr(user_obj, '_perm_cache'):\r\n            user_obj._perm_cache = set(\"%s.%s\" % (p.content_type.app_label, p.codename) for p in user_obj.user_permissions.select_related())\r\n            user_obj._perm_cache.update(self.get_group_permissions(user_obj))\r\n        return user_obj._perm_cache\r\n\r\n    def has_perm(self, user_obj, perm, obj=None):\r\n        if not user_obj.is_active:\r\n            return False\r\n        return perm in self.get_all_permissions(user_obj, obj)\r\n\r\nNotice that `get_all_permissions()` automatically returns an empty set when `obj is not None`. This is because Django's default permissions system doesn't support object-level permissions. It only supports Model-level permissions.\r\n\r\nThe fix for this is to stop passing `obj` into `request.user.has_perm()` in all three `RegistrationAdmin.has_*_permission()` methods. \r\n\r\nPlease fix this as soon as possible, as this is a showstopper bug for my site."},"comment":{"url":"https://api.github.com/repos/lambdalisue/django-inspectional-registration/issues/comments/106871431","html_url":"https://github.com/lambdalisue/django-inspectional-registration/issues/36#issuecomment-106871431","issue_url":"https://api.github.com/repos/lambdalisue/django-inspectional-registration/issues/36","id":106871431,"user":{"login":"coredumperror","id":413571,"avatar_url":"https://avatars.githubusercontent.com/u/413571?v=3","gravatar_id":"","url":"https://api.github.com/users/coredumperror","html_url":"https://github.com/coredumperror","followers_url":"https://api.github.com/users/coredumperror/followers","following_url":"https://api.github.com/users/coredumperror/following{/other_user}","gists_url":"https://api.github.com/users/coredumperror/gists{/gist_id}","starred_url":"https://api.github.com/users/coredumperror/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coredumperror/subscriptions","organizations_url":"https://api.github.com/users/coredumperror/orgs","repos_url":"https://api.github.com/users/coredumperror/repos","events_url":"https://api.github.com/users/coredumperror/events{/privacy}","received_events_url":"https://api.github.com/users/coredumperror/received_events","type":"User","site_admin":false},"created_at":"2015-05-29T17:02:00Z","updated_at":"2015-05-29T17:02:00Z","body":"Heh, I have totally done that before. \"It's such a simple change! I'll just type it out and push it off.\""}}