p15693087
/
django
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fixed #28713 -- Prevented ModelBackend.get_all_permissions() from mutating get_user_permissions().

This commit is contained in:
Yuri Kaszubowski Lopes 2017-10-15 01:47:49 +01:00 committed by Tim Graham
parent c1fa6672dd
commit d98210c255
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
django/contrib/auth/backends.py
View File

@ -75,7 +75,8 @@ class ModelBackend:
if not user_obj.is_active or user_obj.is_anonymous or obj is not None: if not user_obj.is_active or user_obj.is_anonymous or obj is not None:
return set() return set()
if not hasattr(user_obj, '_perm_cache'): if not hasattr(user_obj, '_perm_cache'):
user_obj._perm_cache = self.get_user_permissions(user_obj) user_obj._perm_cache = set()
user_obj._perm_cache.update(self.get_user_permissions(user_obj))
user_obj._perm_cache.update(self.get_group_permissions(user_obj)) user_obj._perm_cache.update(self.get_group_permissions(user_obj))
return user_obj._perm_cache return user_obj._perm_cache

4
tests/auth_tests/test_auth_backends.py
View File

@ -138,7 +138,7 @@ class BaseModelBackendTest:
group.permissions.add(group_perm) group.permissions.add(group_perm)
self.assertEqual(backend.get_all_permissions(user), {'auth.test_user', 'auth.test_group'}) self.assertEqual(backend.get_all_permissions(user), {'auth.test_user', 'auth.test_group'})
self.assertEqual(backend.get_user_permissions(user), {'auth.test_user', 'auth.test_group'}) self.assertEqual(backend.get_user_permissions(user), {'auth.test_user'})
self.assertEqual(backend.get_group_permissions(user), {'auth.test_group'}) self.assertEqual(backend.get_group_permissions(user), {'auth.test_group'})
with mock.patch.object(self.UserModel, 'is_anonymous', True): with mock.patch.object(self.UserModel, 'is_anonymous', True):
@ -164,7 +164,7 @@ class BaseModelBackendTest:
group.permissions.add(group_perm) group.permissions.add(group_perm)
self.assertEqual(backend.get_all_permissions(user), {'auth.test_user', 'auth.test_group'}) self.assertEqual(backend.get_all_permissions(user), {'auth.test_user', 'auth.test_group'})
self.assertEqual(backend.get_user_permissions(user), {'auth.test_user', 'auth.test_group'}) self.assertEqual(backend.get_user_permissions(user), {'auth.test_user'})
self.assertEqual(backend.get_group_permissions(user), {'auth.test_group'}) self.assertEqual(backend.get_group_permissions(user), {'auth.test_group'})
user.is_active = False user.is_active = False