Django Unleashed

20.7 Putting It All Together

In this chapter, we saw how to use the Permission and Group models to build a basic class-level (as opposed to object-level) security system. We used the permissions to control access to our views and to modify what was displayed in our templates.

The User, Permission, and Group models are all related, thanks to many-to-many relations, which allows us to check for individual permissions on a User via the has_perm() method. These permissions are identified by strings such as blog.add_post and are actually instances of Permission, stored in the database. While Django generates add, change, and delete permissions for every model, we can also create our own, typically by defining the permissions attribute in the nested ...