6

Is there a way in Django to give user access to admin privileges by allow only editing of objects that were created by this particular user?

For example I want to give the user permission to create other users but I don't want to allow them to modify users created by admin or other users with this privileges.

I'm using django-admin so the question is in context of it.

1 Answer 1

5

You should override the has_change_permission and has_delete_permission methods on your ModelAdmin class.

For example

class MyModelAdmin(admin.ModelAdmin):

    def has_change_permission(self, request, obj=None):
        if obj is not None and obj.created_by != request.user:
            return False
        return True

    def has_delete_permission(self, request, obj=None):
        if obj is not None and obj.created_by != request.user:
            return False
        return True
4
  • So do you suggest to make a field created_by? Nov 8, 2017 at 14:50
  • You will need to have some way of tracking which user created which object. A ForeignKey to the User table is probably the simplest solution yes Nov 8, 2017 at 14:52
  • Yes, that's kind of the obvious way, actually. But are you sure that author is not tracked by default? Nov 8, 2017 at 14:55
  • The built in auth.User model does not track it's creator. You would have to add this functionality somewhere Nov 8, 2017 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.