Admin "Change password" Button Visible with Only "Can view user" Permission

[Dev Namdev]

There seems to be a bug (or design oversight) in the Django admin panel where the "Change password" button is visible to users who only have the Can view user permission. According to Django's permission model, a user who can only view users should not have access to modifying user details, including changing the password.

Steps to reproduce:

1. Create a superuser and a test user.
2. Grant the test user only the Can view user permission.
3. Log in to the admin panel as the test user.
4. Navigate to the user change page for any user.
5. Observe that the "Change password" button is visible despite the user having no permission to change user details.

[Sarah Boyce]

Thank you for the report
Although this widget was updated in #34977, this behavior existed prior to that so not a release blocker

[Brock Smickley]

struggling with this one but I think I figured out how to test it!

tests/auth_tests/test_views.py

@@ -1704 +1704 @@
             ),
             html=True,
         )
+        self.assertNotContains(response, '<a class="button" href="../password/">Reset password</a>')
         # Value in POST data is ignored.
         data = self.get_user_data(u)
         data["password"] = "shouldnotchange"

Note to self for later: I should also probably test to make sure that the button does show for users with permission.

[Brock Smickley]

I speculate that the solution involves extracting the user's permission and passing it to the context in ReadOnlyPasswordHashWidget, but I'm struggling to figure out how to do that. I was trying to figure out a way to use the ​auth function from context_processors.py but the template isn't rendered by a request, right?

[Sarah Boyce]

This is actually quite similar to #33171
I think maybe if the user has view only permission the password field shouldn't be available (maybe updating get_fieldsets)

[Brock Smickley]

Replying to Sarah Boyce:

This is actually quite similar to #33171
I think maybe if the user has view only permission the password field shouldn't be available (maybe updating get_fieldsets)

ok, I understand how to check the user's permissions from get_fieldsets but then how do I omit the password field from there? I tried messing around with the exclude option as well as the raw fieldsets tuple but I couldn't figure anything out. is there an example of something like this already in the codebase?

[Sarah Boyce]

django/contrib/auth/admin.py

@@ +1 @@
+import copy
 from django.conf import settings
 from django.contrib import admin, messages
 from django.contrib.admin.options import IS_POPUP_VAR
@@ -82 +83 @@
         "user_permissions",
     )
 
+    @staticmethod
+    def _remove_fields_from_fieldsets(fieldsets, fields):
+        fieldset_without_fields = []
+        for fieldset_name, fieldset in copy.deepcopy(fieldsets):
+            fieldset["fields"] = [f for f in fieldset["fields"] if f not in fields]
+            fieldset_without_fields.append((fieldset_name, fieldset))
+        return fieldset_without_fields
+
     def get_fieldsets(self, request, obj=None):
         if not obj:
             return self.add_fieldsets
-        return super().get_fieldsets(request, obj)
+        fieldsets = super().get_fieldsets(request, obj)
+        if not self.has_change_permission(request, obj):
+            return self._remove_fields_from_fieldsets(
+                fieldsets=fieldsets,
+                fields=["password"]
+            )
+        return fieldsets
 
     def get_form(self, request, obj=None, **kwargs):
         """

tests/auth_tests/test_views.py

@@ -1692 +1692 @@
         algo, salt, hash_string = u.password.split("$")
         self.assertContains(response, '<div class="readonly">testclient</div>')
         # ReadOnlyPasswordHashWidget is used to render the field.
-        self.assertContains(
+        self.assertNotContains(
             response,
             "<strong>algorithm</strong>: <bdi>%s</bdi>\n\n"
             "<strong>salt</strong>: <bdi>%s********************</bdi>\n\n"
@@ -1704 +1704 @@
             ),
             html=True,
         )
+        self.assertNotContains(response,'<a class="button" href="../password/">Reset password</a>')
         # Value in POST data is ignored.
         data = self.get_user_data(u)

Something like this maybe?