[Fixed]-Field Level Permission Django

by

5πŸ‘

βœ…

In your admin.py

class ABCAdmin(admin.ModelAdmin):
    fields = [.....]  # here comes the fields open to all users

    def change_view(self, request, object_id, extra_context=None):  # override default admin change behaviour
        if request.user in gruop2:  # an example 
            self.fields.append('field2')  # add field 2 to your `fields` 
            self.fields.append('field3')  # add field 3 to your `fields`

You can use the docs to see what is available. Above is an example taken from one of my usages. You may also need to define change_view and add_view too.

πŸ‘€Mp0int

2πŸ‘

You can also override readonly_fields in changeform_view.

Try this in admin.py

class ABCAdmin(admin.ModelAdmin):

    def changeform_view(self, request, *args, **kwargs)
        self.readonly_fields = list(self.readonly_fields)
        if request.user in group:  #or another condition
            self.readonly_fields.append('field2')

        return super(ABCAdmin, self).changeform_view(request, *args, **kwargs)
πŸ‘€Dawid DΔ™by

2πŸ‘

Just in case someone else stumble about this, I had some issues with the given accepted answer. Every time the view got refreshed, it appended the fields over and over again. As well to the desired restricted view, where it shouldn’t appear.

So, according to the docs, I made it working as follows:

Creating a custom ModelForm

class AbcStaffForm(ModelForm):
    class Meta:
        model = Abc
        exclude = ["manager", "foo", "bar",]

Overwrite get_form() in AbcModelAdmin & refered the custom ModelForm

class AbcAdmin(admin.ModelAdmin):
    # some other code
    # ...
    def get_form(self, request, obj=None, **kwargs):
        if not request.user.is_superuser:
            kwargs['form'] = AbcStaffForm  # ModelForm

        return super().get_form(request, obj, **kwargs)
πŸ‘€swydngr

0πŸ‘

Overwrite get_fields() in ABCAdmin (group B cannot view "is_on" field):

class ABCAdmin(admin.ModelAdmin):
    fields = ['name', 'title', 'price', 'is_on', 'create_time']

    def get_fields(self, request, obj=None):
        if request.user in groupB:
            if 'is_on' not in self.fields:
                self.fields.append('is_on')
        else:
            if 'is_on' in self.fields:
                self.fields.remove('is_on')
        return super(ABCAdmin, self).get_fields(request, obj)
πŸ‘€gtlee

Leave a comment