Login

group_required decorator

Author:
msanders
Posted:
August 27, 2009
Language:
Python
Version:
1.1
Score:
3 (after 3 ratings)

This snippet provides a @group_required decorator. You can pass in multiple groups, for example:

@group_required('admins','editors')
def myview(request, id):
...

Note: the decorator is based on the snippet here but extends it checking first that the user is logged in before testing for group membership - user_passes_test does not check for this by default.

It is important to check that the user is first logged in, as anonymous users trigger an AttributeError when the groups filter is executed.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
from django.contrib.auth.decorators import user_passes_test

def group_required(*group_names):
    """Requires user membership in at least one of the groups passed in."""
    def in_groups(u):
        if u.is_authenticated():
            if bool(u.groups.filter(name__in=group_names)) | u.is_superuser:
                return True
        return False
    return user_passes_test(in_groups)

More like this

  1. Template tag - list punctuation for a list of items by shapiromatron 11 months, 3 weeks ago
  2. JSONRequestMiddleware adds a .json() method to your HttpRequests by cdcarter 11 months, 4 weeks ago
  3. Serializer factory with Django Rest Framework by julio 1 year, 6 months ago
  4. Image compression before saving the new model / work with JPG, PNG by Schleidens 1 year, 7 months ago
  5. Help text hyperlinks by sa2812 1 year, 8 months ago

Comments

mapcuk (on February 25, 2010):

For using it in urls.py shoud write

urlpatterns = patterns('',
    url(r'^$',
        group_required(['root', 'manager'])(views.admin),
        name='admin'),
...

#

bradbeattie (on May 8, 2013):

Avoid a potentially unnecessary database hit by swapping the position of is_superuser and the groups.filter.

#

pstrinkle (on January 12, 2017):

To support modern django rest framework APIViews (class-based views).

@method_decorator(group_required('groupa', 'groupb'))

#

aromerooca (on January 3, 2018):

Since version >=1.10 is_authenticated is an attribute instead of a method. For newer versions you have to remove parenthesis:

(https://docs.djangoproject.com/en/1.10/ref/contrib/auth/#django.contrib.auth.models.User.is_authenticated)

#

BrRoman (on September 1, 2022):

Line 7: I have had to correct "|" by "or".

(Python 3.7, Django 3.2)

#

Please login first before commenting.