[Django]-Django is_staff permission decorator

by

125👍

✅

is_staff isn’t a permission so instead of permission_required you could use:

@user_passes_test(lambda u: u.is_staff)

or 

from django.contrib.admin.views.decorators import staff_member_required

@staff_member_required
👤arie

10👍

for Class Based Views you can add permission_required('is_staff') to the urls.py:

from django.contrib.auth.decorators import permission_required

url(r'^your-url$', permission_required('is_staff')(YourView.as_view()), name='my-view'),
👤Nikolay Georgiev

9👍

For class-based views, the UserPassesTestMixin is convenient, e.g.

class ImportFilePostView(LoginRequiredMixin, UserPassesTestMixin):
  def test_func(self):
    return self.request.user.is_staff
  ...
👤Shadi

0👍

A variant of @arie ‘s answer without lambda which might be a tad faster (but I didn’t check):

import operator
from django.contrib.auth.decorators import user_passes_test

@user_passes_test(operator.attrgetter('is_staff'))
def my_view(....)

Having said that, I think the better approach is to create a Permission for your view and use it with the permission_required decorator.

👤Uwe Kleine-König

Leave a comment