Opened 3 years ago

Closed 3 years ago

#33269 closed Cleanup/optimization (fixed)

Raise an error if a string is passed into has_perms() instead of a list

Reported by: lieryan Owned by: lieryan
Component: contrib.auth Version: 3.2
Severity: Normal Keywords:
Cc: Triage Stage: Ready for checkin
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description (last modified by lieryan)

A colleague made this error recently doing a user.has_perms("foobar") instead of the correct user.has_perms(["foobar"]) or user.has_perm("foobar"). The code initially appeared to work fine since in Python, str is an iterable that returned individual characters as string when iterated over.

We checked for str in particular rather than enforcing it to be a list, since perm_list may actually be tuple, set, generators, or other iterables.

An alternative way this could be fixed is to just silently behave like has_perm() if perm_list is actually a string rather than raising an error, but that'll probably enforce a bad habit.

Pull request in Github (https://github.com/django/django/pull/14969).

Change History (7)

comment:1 by lieryan, 3 years ago

Description: modified (diff)

comment:2 by lieryan, 3 years ago

Description: modified (diff)

comment:3 by lieryan, 3 years ago

Description: modified (diff)

comment:4 by lieryan, 3 years ago

Component: Uncategorizedcontrib.auth

comment:5 by Mariusz Felisiak, 3 years ago

Owner: changed from nobody to lieryan
Patch needs improvement: set
Status: newassigned
Triage Stage: UnreviewedAccepted
Type: UncategorizedCleanup/optimization

comment:6 by Mariusz Felisiak, 3 years ago

Patch needs improvement: unset
Triage Stage: AcceptedReady for checkin

comment:7 by Mariusz Felisiak <felisiak.mariusz@…>, 3 years ago

Resolution: fixed
Status: assignedclosed

In 05cde47:

Fixed #33269 -- Made AnonymousUser/PermissionsMixin.has_perms() raise ValueError on string or non-iterable perm_list.

Note: See TracTickets for help on using tickets.
Back to Top