You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
There seems to be a bit of confusion in the code regarding the global permissions. When we get the user list we only check for object permissions. Then when we retrieve the permissions we merge the global permissions and the object permissions.
We need to be a bit more consistent as to if we use the global permissions or not.
Have added the 'API change' label to this, as fixing this is going to change the API which people may be relying on. So fixing should perhaps be done in a major release.
Hi,
Using django-guardian 1.2.5.
When a superuser has no specific permission for a particular object, the get_users_with_perms shortcut works as expected:
But if we grant that user a particular permission to that object, get_users_with_perms then reports that the user has all permissions for it:
This seems a surprising behavior. I would have expected this instead:
Thanks,
Kevin
The text was updated successfully, but these errors were encountered: