should check has_add_permission(), not has_change_permission(), in user add view

[dfrishberg@…]

django/contrib/auth/admin.py:UserAdmin:add_view(): The first thing that is done is to check whether the user has change permissions. This should be add permissions for the add view.

[Karen Tracey <kmtracey@…>]

Looks to be the same check as is done for the old admin (see ​http://code.djangoproject.com/browser/django/trunk/django/contrib/admin/views/auth.py#L11). Since it doesn't seem to have been behavior introduced by nfa, should not block merge.

[Karen Tracey <kmtracey@…>]

#7606 is a dup

[Matthias Kestenholz]

It's not as simple as just changing has_change_permission to has_add_permission. The place where the user should be redirected to has to be determined with has_change_permission (either continue editing the newly created user or redirect to the admin frontpage).

[Matthias Kestenholz]

From django/contrib/auth/admin.py:

def add_view(self, request):

# It's an error for a user to have add permission but NOT change
# permission for users. If we allowed such users to add users, they
# could create superusers, which would mean they would essentially have
# the permission to change users. To avoid the problem entirely, we
# disallow users from adding users if they don't have change
# permission.