U
U
user.2019-03-12 16:49:58
Django
user., 2019-03-12 16:49:58

Is there a decorator in django to set access permissions to the required function in the View?

Good afternoon,
I understand FW Django, can you tell me if it is possible to add a decorator above each path () in VIew.py and indicate in it the name of the group of users who are allowed access?
I created a super user, went to the admin panel, but did not understand how I can set the necessary rights for my user to access only certain methods. In the @login_required decorator, which is used in Models, as far as I understand, we cannot pass the role name to users who are allowed access to the corresponding method.
PS: I apologize if the question is technically not quite literate.
Example of my Urls.py:

path('accueil', views.connexion , name='connexion'),
    path('accueilEmploye', views.connexionEmploye , name='connexion'),
    path('deconnexion', views.deconnexion, name='deconnexion'),
    path('liste_projets/<int:id>', views.list_projet), #client
    path('liste_tickets/<int:id_projet>', views.list_tickets), #client
    path('ajout_tickets/<int:id_ticket>', views.add_ticket), #client
    path('liste_demande', views.list_projets_clients), 
    path('affectation_ticket/<int:id_projet>', views.liste_tickets_clients),
    path('liste_tickets_assigne/<int:id_ticket>', views.liste_tickets_assigne),

    path('detail_tickets_assigne/<int:id_ticket>', views.detail_ticket_assigne),

Here's the Models.py my goal is to restrict some users' access to not some methods
from django.shortcuts import render
from django.shortcuts import render
from django.contrib.auth.decorators import login_required
from django.contrib.auth import logout
from django.shortcuts import render
from django.core.urlresolvers import reverse

# Create your views here.
def connexion(request):
  error = False

    if request.method == "POST":
        form = ConnexionForm(request.POST)
        if form.is_valid():
            username = form.cleaned_data["username"]
            password = form.cleaned_data["password"]
            user = authenticate(username=username, password=password)  # Nous vérifions si les données sont correctes
            if user:  # Si l'objet renvoyé n'est pas None
                login(request, user)  # nous connectons l'utilisateur
            else: # sinon une erreur sera affichée
                error = True
    else:
        form = ConnexionForm()

    return render(request, 'appticket/connexion.html', locals())



def deconnexion(request):
    logout(request)
    return redirect(reverse(connexion))

@login_required
def list_projet(request,id):
  try:
    projets = Projet.objects.get(client=id)
  except Projet.DoesNotExist:
    raise Http404
  return render(request, 'blog/list_projet.html', {'projets': projets})


@login_required
def list_tickets(request,id_projet):
  try:
    tickets = Ticket.objects.get(projet=id_projet)
  except Ticket.DoesNotExist:
    raise Http404
  return render(request, 'blog/list_tickets.html', {'tickets': tickets})


@login_required
def add_ticket(request,id_ticket):
  ticket = 0;
  try:
    ticket = Ticket.objects.get(id=id_ticket)
  except Ticket.DoesNotExist:
    raise Http404
  return render(request, 'blog/add_ticket.html', {'ticket': ticket})

@login_required
def list_projets_clients(request):
  try:
    projets = Projet.objects.all()
  except Projet.DoesNotExist:
    raise Http404
  return render(request, 'blog/list_projets_clients.html', {'projets': projets})

@login_required
def liste_tickets_clients(request,id_projet):
  try:
    tickets = Ticket.objects.get(projet=id_projet)
  except Ticket.DoesNotExist:
    raise Http404
  return render(request, 'blog/liste_tickets_clients.html', {'tickets': tickets})


@login_required
def liste_tickets_assigne(request,id_ticket):
  try:
    ticket = Ticket.objects.get(id=id_projet)
  except Ticket.DoesNotExist:
    raise Http404
  return render(request, 'blog/liste_tickets_assigne.html', {'ticket': ticket})


@login_required
def add_ticket(request,id_ticket):
  ticket = 0;
  try:
    ticket = Ticket.objects.get(id=id_ticket)
  except Ticket.DoesNotExist:
    raise Http404
  return render(request, 'blog/det_ticket.html', {'ticket': ticket})

Answer the question

In order to leave comments, you need to log in

1 answer(s)
X
x_dmitry_x, 2019-03-12
@x_dmitry_x

If I understand the author correctly, then you need @permission_required
https://docs.djangoproject.com/en/2.1/topics/auth/...

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question