Django is_staff permission designer

Question

I am trying to restrict access to pages using 2 user levels. Superuser and administrator. The superuser is a regular Django user with "is_superuser" assigned. The Admin user is also a regular user who is assigned only the permission of 'is_staff'.

The problem is that when I use this decorator for the admin user, it does not pass the test:

@permission_required('is_staff') def my_view(....) 

@permission_required('is_staff') returns false for anonymous users. (Right)
@permission_required('is_superuser') returns true only for superusers (correct)
@permission_required('is_staff') returns FALSE for users with the assigned variable 'is_staff'. (Wrong).

Any thoughts?

Answer 1

is_staff not a permission, so instead of permission_required you can use:

 @user_passes_test(lambda u: u.is_staff) 

or

 from django.contrib.admin.views.decorators import staff_member_required @staff_member_required 

Answer 2

for classes based on classes, you can add permission_required('is_staff') to urls.py :

 from django.contrib.auth.decorators import permission_required url(r'^your-url$', permission_required('is_staff')(YourView.as_view()), name='my-view'), 

Answer 3

ATTENTION: after a thorough check of this solution does not work

In Django 1.10, @ Nikolay Georgiev’s work works. In CBV you can use The PermissionRequiredMixin mixin

 from django.contrib.auth.mixins import PermissionRequiredMixin from django.http import HttpResponse class MyView(PermissionRequiredMixin, View): permission_required = 'is_staff' def get(self, request): return HttpResponse('result')