On Thursday 09 March 2017 12:51:26 Antonis Christofides wrote: > One solution that I've implemented in an app is to have middleware > that stores the request in a thread local variable. The model manager > gets the request from there and filters the results accordingly. If > there is no request object stored in the thread local variable, the > manager assumes this query does not come from the web and does not > filter it. > > Is this a good way to do it? Is there any alternative?
So you've rebranded your problem from "remembering to do this in views" to "remembering you've used the right model manager". The only way to solve it, is to use a default-deny authentication backend, where the view needs to whitelist permissions. That way never anything leaks and your memory is no longer a factor in the problem. But....it assumes one url handles one object, which isn't the case in most projects. The obvious reason for not tying a model to a request, is that you cannot obtain instances without a request (management commands, among which data migrations). You have to remember something somewhere and tests are the place to assert you did (if you remember to write a test for it ...). -- Melvyn Sopacua -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscr...@googlegroups.com. To post to this group, send email to django-users@googlegroups.com. Visit this group at https://groups.google.com/group/django-users. To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/1570464.pXdMm1KXXq%40devstation. For more options, visit https://groups.google.com/d/optout.
