1

I'm attempting to override some of the behaviour of the Django UserAdmin model. Particularly, I'd like to hide the 'superuser' field from non-superusers.

So, my approach is this:

class ModelAdmin(BaseModelAdmin):
    "Encapsulates all admin options and functionality for a given model."

    # ...

    def has_change_permission(self, request, obj=None):
        """
        Returns True if the given request has permission to change the given
        Django model instance.

        If `obj` is None, this should return True if the given request has
        permission to change *any* object of the given type.
        """
        opts = self.opts
        return request.user.has_perm(opts.app_label + '.' + opts.get_change_permission())

    #...

Based on what I've found in ModelAdmin

class UserAdmin(UserAdmin):
    """
    ... my customised UserAdmin
    """

    # adding a new method
    def is_superuser(self, request):
        "Returns True if the given user is a superuser."
        return request.user.is_superuser

    # then elsewhere 'hopefully' show a slightly different fieldset
    # the following, of course, doesn't work.

    fieldsets = (
        (None, {
            'fields': (
                ("first_name", "last_name"), 
                ("email", "password"), 
                "is_staff", 
                "is_active", 
                "is_superuser" if self.is_superuser() else None

            )   
        }),
        ('Groups', {
            'fields': (
                'groups', 
            )
        }),
        ('Meta', {
            'classes': ('collapse',),
            'fields': (
                'username',
                "last_login", 
                "date_joined"
            )
        })
    )

So, my questions are:

  • How do I create a def within my new custom UserAdmin class, such as above, and how do I call it? (How do I know when I'm in the right context to do so)
  • Part 2 (bonus): how can I succinctly include/exclude the 'is_superuser' field in the form, as the psuedo code above is suggesting?

Kind thanks fellows!

~ Daryl

Thank you

2
  • Stackers, never heard that one before... Dec 1, 2010 at 3:45
  • Normally, I'd think what you're going to need to do is create a custom form and assign it to your admin's form member. Thing is, this level of customization is usually done from a view and not a model; everything I can think of won't have request available. In other words, you could hide "Is Superuser" for everybody, which isn't what you want, right? Dec 19, 2010 at 5:52

2 Answers 2

1

If you just want to forbid users to promote themselves to superuser, override YourUserAdmin.get_readonly_fields():

class YourUserAdmin(admin.ModelAdmin):
    ...
    def get_readonly_fields(self, request, obj=None):
        if request.user.is_superuser:
            return None
        try:
            return self.readonly_fields + ('is_superuser',)
        except:
            return ('is_superuser',)

You have to unregister the default User/UserAdmin and then register your own.

admin.site.unregister(User)
admin.site.register(User, YourUserAdmin)

However, the ZEN of admin says:

At it's core, Django's admin is designed for a single activity: trusted users editing structured content.

If the user is not trusted, do not give him edit rights to edit user accounts, period. Even if you hide the superadmin option and the "filter by superadmin status" filter, he can just change your password and log in as you. So, if you need some untrusted users to edit user accounts, forget the admin and write your own dumbed down interface.

4
  • Daryl doesn't want the Is Superuser field to be uneditable; he wants it gone. Dec 19, 2010 at 5:50
  • @Mike DeSimone: this makes no sense since the information is available in the user list (filter by superuser status). Dec 19, 2010 at 6:07
  • Bet he'd ask how to hide that next. Dec 19, 2010 at 6:44
  • @Mike: somewhat useless, because even hiding the superadmin option and the "filter by superadmin status" filter, someone can just change Daryls password and log in with his credentials. Dec 19, 2010 at 7:42
0

No experience with Django but thinking a closure might help you in this situation:

class UserAdmin(UserAdmin):

    # adding a new method
    def is_superuser(self, request):
        "Returns True if the given user is a superuser."
        return request.user.is_superuser

    def gen_fieldset(self, request):
        '''
        If request.user.is_supeuser == true then return fieldset generator for superuser.
         Else return fieldset generator for normal user.
         ''' 
        su = is_superuser(request)
        def get_fieldset():
            if su:
                return super_user_fieldset
            else:
                return normal_user_fieldset
        return get_fieldset

Usage would go like this:

obj = UserAdmin()
request = ... #Generate a normal or super-user request.
fieldset = obj.gen_fieldset(request)
# Sometime later when you want to use the fieldset...
fields = fieldset() # Function will decide which fieldset to give based on gen_fieldset() call earlier.

So the basic idea is that you can configure get_fieldset() ahead of time (via the call to gen_fieldset() where the closure is employed) to return the appropriate fieldset for the user's level. Give the user the function object returned by gen_fieldset() it'll generate the appropriate fieldset at a later time whenever the user calls it.

NOTE: If you've never used closures before I'd suggest googling around for other examples and use scenarios. There may be other solutions that'll fit your situation better (again, not familiar with Django) but that was the first thing that came to my mind.

1
  • Not sure that would work because Django's models are based on metaclasses, which go through the class's members to create the real class. So it'll be looking for a member named fieldsets to use to generate the form. Dec 19, 2010 at 5:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.