1 from django import template |
1 from django import template |
|
2 from django.db import transaction |
2 from django.conf import settings |
3 from django.conf import settings |
3 from django.contrib import admin |
4 from django.contrib import admin |
4 from django.contrib.auth.forms import UserCreationForm, UserChangeForm, AdminPasswordChangeForm |
5 from django.contrib.auth.forms import UserCreationForm, UserChangeForm, AdminPasswordChangeForm |
5 from django.contrib.auth.models import User, Group |
6 from django.contrib.auth.models import User, Group |
|
7 from django.contrib import messages |
6 from django.core.exceptions import PermissionDenied |
8 from django.core.exceptions import PermissionDenied |
7 from django.http import HttpResponseRedirect, Http404 |
9 from django.http import HttpResponseRedirect, Http404 |
8 from django.shortcuts import render_to_response, get_object_or_404 |
10 from django.shortcuts import render_to_response, get_object_or_404 |
9 from django.template import RequestContext |
11 from django.template import RequestContext |
10 from django.utils.html import escape |
12 from django.utils.html import escape |
|
13 from django.utils.decorators import method_decorator |
11 from django.utils.translation import ugettext, ugettext_lazy as _ |
14 from django.utils.translation import ugettext, ugettext_lazy as _ |
|
15 from django.views.decorators.csrf import csrf_protect |
|
16 |
|
17 csrf_protect_m = method_decorator(csrf_protect) |
12 |
18 |
13 class GroupAdmin(admin.ModelAdmin): |
19 class GroupAdmin(admin.ModelAdmin): |
14 search_fields = ('name',) |
20 search_fields = ('name',) |
15 ordering = ('name',) |
21 ordering = ('name',) |
16 filter_horizontal = ('permissions',) |
22 filter_horizontal = ('permissions',) |
17 |
23 |
18 class UserAdmin(admin.ModelAdmin): |
24 class UserAdmin(admin.ModelAdmin): |
|
25 add_form_template = 'admin/auth/user/add_form.html' |
|
26 change_user_password_template = None |
19 fieldsets = ( |
27 fieldsets = ( |
20 (None, {'fields': ('username', 'password')}), |
28 (None, {'fields': ('username', 'password')}), |
21 (_('Personal info'), {'fields': ('first_name', 'last_name', 'email')}), |
29 (_('Personal info'), {'fields': ('first_name', 'last_name', 'email')}), |
22 (_('Permissions'), {'fields': ('is_staff', 'is_active', 'is_superuser', 'user_permissions')}), |
30 (_('Permissions'), {'fields': ('is_active', 'is_staff', 'is_superuser', 'user_permissions')}), |
23 (_('Important dates'), {'fields': ('last_login', 'date_joined')}), |
31 (_('Important dates'), {'fields': ('last_login', 'date_joined')}), |
24 (_('Groups'), {'fields': ('groups',)}), |
32 (_('Groups'), {'fields': ('groups',)}), |
|
33 ) |
|
34 add_fieldsets = ( |
|
35 (None, { |
|
36 'classes': ('wide',), |
|
37 'fields': ('username', 'password1', 'password2')} |
|
38 ), |
25 ) |
39 ) |
26 form = UserChangeForm |
40 form = UserChangeForm |
27 add_form = UserCreationForm |
41 add_form = UserCreationForm |
28 change_password_form = AdminPasswordChangeForm |
42 change_password_form = AdminPasswordChangeForm |
29 list_display = ('username', 'email', 'first_name', 'last_name', 'is_staff') |
43 list_display = ('username', 'email', 'first_name', 'last_name', 'is_staff') |
38 if url is None: |
52 if url is None: |
39 return self.changelist_view(request) |
53 return self.changelist_view(request) |
40 if url.endswith('password'): |
54 if url.endswith('password'): |
41 return self.user_change_password(request, url.split('/')[0]) |
55 return self.user_change_password(request, url.split('/')[0]) |
42 return super(UserAdmin, self).__call__(request, url) |
56 return super(UserAdmin, self).__call__(request, url) |
43 |
57 |
|
58 def get_fieldsets(self, request, obj=None): |
|
59 if not obj: |
|
60 return self.add_fieldsets |
|
61 return super(UserAdmin, self).get_fieldsets(request, obj) |
|
62 |
|
63 def get_form(self, request, obj=None, **kwargs): |
|
64 """ |
|
65 Use special form during user creation |
|
66 """ |
|
67 defaults = {} |
|
68 if obj is None: |
|
69 defaults.update({ |
|
70 'form': self.add_form, |
|
71 'fields': admin.util.flatten_fieldsets(self.add_fieldsets), |
|
72 }) |
|
73 defaults.update(kwargs) |
|
74 return super(UserAdmin, self).get_form(request, obj, **defaults) |
|
75 |
44 def get_urls(self): |
76 def get_urls(self): |
45 from django.conf.urls.defaults import patterns |
77 from django.conf.urls.defaults import patterns |
46 return patterns('', |
78 return patterns('', |
47 (r'^(\d+)/password/$', self.admin_site.admin_view(self.user_change_password)) |
79 (r'^(\d+)/password/$', self.admin_site.admin_view(self.user_change_password)) |
48 ) + super(UserAdmin, self).get_urls() |
80 ) + super(UserAdmin, self).get_urls() |
49 |
81 |
50 def add_view(self, request): |
82 @csrf_protect_m |
|
83 @transaction.commit_on_success |
|
84 def add_view(self, request, form_url='', extra_context=None): |
51 # It's an error for a user to have add permission but NOT change |
85 # It's an error for a user to have add permission but NOT change |
52 # permission for users. If we allowed such users to add users, they |
86 # permission for users. If we allowed such users to add users, they |
53 # could create superusers, which would mean they would essentially have |
87 # could create superusers, which would mean they would essentially have |
54 # the permission to change users. To avoid the problem entirely, we |
88 # the permission to change users. To avoid the problem entirely, we |
55 # disallow users from adding users if they don't have change |
89 # disallow users from adding users if they don't have change |
58 if self.has_add_permission(request) and settings.DEBUG: |
92 if self.has_add_permission(request) and settings.DEBUG: |
59 # Raise Http404 in debug mode so that the user gets a helpful |
93 # Raise Http404 in debug mode so that the user gets a helpful |
60 # error message. |
94 # error message. |
61 raise Http404('Your user does not have the "Change user" permission. In order to add users, Django requires that your user account have both the "Add user" and "Change user" permissions set.') |
95 raise Http404('Your user does not have the "Change user" permission. In order to add users, Django requires that your user account have both the "Add user" and "Change user" permissions set.') |
62 raise PermissionDenied |
96 raise PermissionDenied |
63 if request.method == 'POST': |
97 if extra_context is None: |
64 form = self.add_form(request.POST) |
98 extra_context = {} |
65 if form.is_valid(): |
99 defaults = { |
66 new_user = form.save() |
|
67 msg = _('The %(name)s "%(obj)s" was added successfully.') % {'name': 'user', 'obj': new_user} |
|
68 self.log_addition(request, new_user) |
|
69 if "_addanother" in request.POST: |
|
70 request.user.message_set.create(message=msg) |
|
71 return HttpResponseRedirect(request.path) |
|
72 elif '_popup' in request.REQUEST: |
|
73 return self.response_add(request, new_user) |
|
74 else: |
|
75 request.user.message_set.create(message=msg + ' ' + ugettext("You may edit it again below.")) |
|
76 return HttpResponseRedirect('../%s/' % new_user.id) |
|
77 else: |
|
78 form = self.add_form() |
|
79 return render_to_response('admin/auth/user/add_form.html', { |
|
80 'title': _('Add user'), |
|
81 'form': form, |
|
82 'is_popup': '_popup' in request.REQUEST, |
|
83 'add': True, |
|
84 'change': False, |
|
85 'has_add_permission': True, |
|
86 'has_delete_permission': False, |
|
87 'has_change_permission': True, |
|
88 'has_file_field': False, |
|
89 'has_absolute_url': False, |
|
90 'auto_populated_fields': (), |
100 'auto_populated_fields': (), |
91 'opts': self.model._meta, |
|
92 'save_as': False, |
|
93 'username_help_text': self.model._meta.get_field('username').help_text, |
101 'username_help_text': self.model._meta.get_field('username').help_text, |
94 'root_path': self.admin_site.root_path, |
102 } |
95 'app_label': self.model._meta.app_label, |
103 extra_context.update(defaults) |
96 }, context_instance=template.RequestContext(request)) |
104 return super(UserAdmin, self).add_view(request, form_url, extra_context) |
97 |
105 |
98 def user_change_password(self, request, id): |
106 def user_change_password(self, request, id): |
99 if not self.has_change_permission(request): |
107 if not self.has_change_permission(request): |
100 raise PermissionDenied |
108 raise PermissionDenied |
101 user = get_object_or_404(self.model, pk=id) |
109 user = get_object_or_404(self.model, pk=id) |
102 if request.method == 'POST': |
110 if request.method == 'POST': |
103 form = self.change_password_form(user, request.POST) |
111 form = self.change_password_form(user, request.POST) |
104 if form.is_valid(): |
112 if form.is_valid(): |
105 new_user = form.save() |
113 new_user = form.save() |
106 msg = ugettext('Password changed successfully.') |
114 msg = ugettext('Password changed successfully.') |
107 request.user.message_set.create(message=msg) |
115 messages.success(request, msg) |
108 return HttpResponseRedirect('..') |
116 return HttpResponseRedirect('..') |
109 else: |
117 else: |
110 form = self.change_password_form(user) |
118 form = self.change_password_form(user) |
111 return render_to_response('admin/auth/user/change_password.html', { |
119 |
|
120 fieldsets = [(None, {'fields': form.base_fields.keys()})] |
|
121 adminForm = admin.helpers.AdminForm(form, fieldsets, {}) |
|
122 |
|
123 return render_to_response(self.change_user_password_template or 'admin/auth/user/change_password.html', { |
112 'title': _('Change password: %s') % escape(user.username), |
124 'title': _('Change password: %s') % escape(user.username), |
|
125 'adminForm': adminForm, |
113 'form': form, |
126 'form': form, |
114 'is_popup': '_popup' in request.REQUEST, |
127 'is_popup': '_popup' in request.REQUEST, |
115 'add': True, |
128 'add': True, |
116 'change': False, |
129 'change': False, |
117 'has_delete_permission': False, |
130 'has_delete_permission': False, |