#21063: AdminSite app_index does work it doesn't need to
-----------------------------------------+--------------------
Reporter: Keryn Knight <django@…> | Owner: nobody
Type: Cleanup/optimization | Status: new
Component: contrib.admin | Version: master
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 1
Easy pickings: 0 | UI/UX: 0
-----------------------------------------+--------------------
If a user doesn't have permissions to a module (as defined by it's app
label), the way the
[https://github.com/django/django/blob/ec47de77d6a7bc9327047d157fb5706751413f18/django/contrib/admin/sites.py#L403
app_index] works, it will still go through the motions of iterating the
modeladmin registry and checking permissions it knows cannot be true, as
far as I can see. Having done all that, if the `app_dict` is empty [and it
should be], it
[https://github.com/django/django/blob/ec47de77d6a7bc9327047d157fb5706751413f18/django/contrib/admin/sites.py#L441
throws a 404], whereas the ModelAdmin views themselves tend to
[https://github.com/django/django/blob/ec47de77d6a7bc9327047d157fb5706751413f18/django/contrib/admin/options.py#L1137
raise PermissionDenied]. The fix is pretty simple, and actually simplifies
the view, if you believe shallow trumps deep.
Marking as has patch on the basis on an incoming GitHub pull request.
--
Ticket URL: <https://code.djangoproject.com/ticket/21063>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/080.8863ba429b4182fa724f0756836423ad%40djangoproject.com.
For more options, visit https://groups.google.com/groups/opt_out.
