mtigas

#admin.py for newforms-admin permissions example
#see http://www.miketigas.com/?p=625
from django.contrib import admin
from myapp.models import Blog,BlogPost

class BlogAdmin(admin.ModelAdmin):
  prepopulated_fields = {'slug': ('name',)}

  # a similar delete_permission should be written
  def has_change_permission(self, request, obj=None):
    # if user has special permission (or is superuser) allow all changes
    if request.user.is_superuser or request.user.has_perm('myapp.access_all_blogs'):
      return true
    # allow changes if logged in as the "owner"
    elif obj:
      return (request.user == obj.user)
    # otherwise, pick up the default internal Django behavior
    else:
      return super(BlogAdmin, self).has_change_permission(request, obj)

  # Filter the blogs that show up in the admin panel.
  def queryset(self, request):
    # get the default queryset, pre-filter
    qs = super(BlogAdmin, self).queryset(request)
    # only do the filter if we don't have special permission to see all blogs
    if not (request.user.is_superuser or request.user.has_perm('myapp.access_all_blogs')):
      # filter only shows blogs mapped to currently logged-in user
      qs = qs.filter(user=request.user)
    return qs

class BlogPostAdmin(admin.ModelAdmin):
  prepopulated_fields = {'slug': ('title',)}

  def has_change_permission(self, request, obj=None):
    # if user has special permission (or is superuser) allow all changes
    if request.user.is_superuser or request.user.has_perm('myapp.access_all_posts'):
      return true
    # allow changes if logged in as the "owner"
    elif obj:
      return (request.user == obj.blog.user)
    # otherwise, pick up the default internal Django behavior
    else:
      return super(BlogPostAdmin, self).has_change_permission(request, obj)

  # Filter the posts that show up in the admin panel.
  def queryset(self, request):
    qs = super(BlogPostAdmin, self).queryset(request)
    if not (request.user.is_superuser or request.user.has_perm('myapp.access_all_posts')):
      # filter only shows blogs mapped to currently logged-in user
      qs = qs.filter(blog__user=request.user)
    return qs

admin.site.register(Blog,BlogAdmin)
admin.site.register(BlogPost,BlogPostAdmin)