django进阶3 权限设计和使用

修改blog/urls.py

urlpatterns = [

    url(r'^$', views.index, name='index'),

    url(r'^login/$', views.login, name='login'),

    url(r'^logout/$', views.logout, name='logout'),

    url(r'^register/$', views.register, name='register'),

]

-------------------------

修改blog/views.py 

增加register 视图函数

import uuid

...

def register(request):

    if ('mail' or 'pwd') not in request.GET:

        lf = LoginForm()

        return   render_to_response('register.html', {'lf':lf})

    lf = LoginForm(request.GET)

    email = lf.data['email']

    pwd = lf.data['pwd']

    user = User()

    user.username = uuid.uuid1()

    user.email = email

    user.set_password(pwd)

    user.desc = 'kaka user'

    user.save()

    return HttpResponseRedirect('/blog/login/')

-----------------------------

修改blog/models.py

增加news类, 并设计权限

class news(models.Model):

    list_field = [

        'id', 'new_thread', 'news_title', 'news_url', 'new_time', 'news_from',

        'from_url', 'news_body'

    ]

    news_thread = models.TextField(blank=True, null=True)

    news_title = models.TextField(blank=True, null=True)

    news_url = models.TextField(blank=True, null=True)

    news_time = models.TextField(blank=True, null=True)

    news_from = models.TextField(blank=True, null=True)

    from_url = models.TextField(blank=True, null=True)

    news_body = models.TextField(blank=True, null=True)

    dele = models.BooleanField(default=0)

    def __str__(self):

        return models.Model.__str__(self)

    class Meta:

        permissions = (('can_view', 'Can see news'),

                        ('can_edit', 'Can edit news'),

                        ('can_add', 'Can add news'),

                        ('can_delete', 'Can delete news'),

                        )

mange.py 下

$ makemigrations

$ migrate

后可见MySQL auth_permission表中新增了3个权限

-----------------------------------

给注册用添加权限

blog/views.py

from django.contrib.auth.models import Permission

def register(request):

    if ('email' or 'pwd') not in request.GET:

        lf = LoginForm()

        return   render_to_response('register.html', {'lf':lf})

    lf = LoginForm(request.GET)

    email = lf.data['email']

    pwd = lf.data['pwd']

    user = User()

    user.username = uuid.uuid1()

    user.email = email

    user.set_password(pwd)

    user.desc = 'kaka user'

    user.save()

    user.user_permissions = [

        Permission.objects.get(codename='can_view'),

        Permission.objects.get(codename='can_add'),

    ]

    return HttpResponseRedirect('/blog/login/')

--------------------------

在login视图函数中测试

def login(request):

    if ('email' or 'pwd') not in request.GET:

        lf = LoginForm()

        return render_to_response('login.html', {'lf': lf})

    lf = LoginForm(request.GET)

    email = lf.data['email']

    pwd = lf.data['pwd']

    try:

        user = User.objects.get(email = email);

    except User.DoesNotExist:

        pass

    else:

        if user.check_password(pwd):

            if user.has_perm('blog.can_view'):

                return HttpResponse('you can view news')

            request.session['email'] = email

            return HttpResponseRedirect('/blog/')

            # return HttpResponse('login in with ' + user.username)

    # return HttpResponseRedirect(reverse('blog:login'))

    return HttpResponseRedirect('/blog/login/')

----------------------------------