105

Can I use the Auth application's permission checking inside a template in Django? (I want to display a simple form at the end of the template for privileged users)

And more importantly, should I do it at all or is this no the "Django way"?

Daniel
  • 2,328
  • 3
  • 17
  • 31
  • 1
    For people like me, who stumble upon this later, the link for Django 1.5 was changed slightly. The information can now be found in the docs at this url: https://docs.djangoproject.com/en/1.5/topics/auth/default/#permissions Nothing in the original answer really changed, but this is just a new url :) – Xudonax Sep 10 '13 at 07:35

4 Answers4

201

If you are looking to check for permissions in templates, the following code would suffice:

{% if perms.app_label.can_do_something %}
<form here>
{% endif %}

Where model refers to the model that the user need permissions to see the form for.

Refer to https://docs.djangoproject.com/en/stable/topics/auth/default/#permissions for more examples.

The currently logged-in user's permissions are stored in the template variable {{ perms }}

(This requires the following context processor to be enabled: django.contrib.auth.context_processors.auth)

Flimm
  • 97,949
  • 30
  • 201
  • 217
Victor Neo
  • 2,602
  • 1
  • 14
  • 13
  • 19
    Note that if you're logged in as a superuser, `perms.app_label.foobar` will always be true, even if you misspelled the permission name. – Flimm Apr 26 '17 at 18:45
  • 2
    Also note here that "can_do_something" is the name of the permission, so you don't need to add a prefix "can" to the permission name. E.g., perms.my_app.add_object – Karim Sonbol Sep 21 '18 at 09:54
15

Tested on Django 2.0 +

If you want to see all the permissions the logged in user has, on your template (.html), print : 

{{ perms.app_name }}

Or

{{ perms }}

In order to check if user has permission , use:

{% if perms.app_name.change_model_name_lower_cased %}

E.g : 

{% if perms.Utilization.change_invoice %}

Here: Utilization is my App name. Invoice is a model name.

Note that in general, there will be 4 kinds of permissions:

  • change [E.g Utilization.change_projectemail]
  • view [E.g Utilization.view_invoice]
  • delete [E.g Utilization.delete_invoicetype]
  • add [E.g Utilization.add_invoicetype]

Also , if you want to see all permissions a user has due to the groups he belongs to, launch Django shell...

user = User.objects.get(username='somename')
user.get_group_permissions()

Here, all permissions listed, are due to the groups he belongs to.

Arindam Roychowdhury
  • 3,975
  • 5
  • 43
  • 52
  • 3
    Yes. Really: lowercased. Not snake_cased. The idea to see permissions with {{perms}} is great, so I think this is the best answer. – mirek Oct 23 '20 at 13:35
3

If you need more granularity in checking perms (on a particular object for example), check out this extension: http://django-authority.readthedocs.org/en/latest/check_templates/

lai
  • 875
  • 9
  • 13
1

One more Unique way to do this is:

{% if 'app_label.permission' in perms %}
<form here>
{% endif %}

Example:

{% if 'auth.view_group' in perms %}
<p> Hello World! </p>
{% endif %}

This comes handy when you want to use your default/custom authentication permissions whether you've created an app for your model or not because this method don't need an app name. It just need the permission name from your permissions table.

You can put multiple checks also using and/or commands:

{% if 'auth.view_group' in perms and 'auth.add_group' in perms %}
<form here>
{% endif %}
Amar Kumar
  • 1,490
  • 2
  • 11
  • 25