时间戳

首页 > 解决方案 > 如何仅授予特定用户组的访问权限以进行登录-django

python - 如何仅授予特定用户组的访问权限以进行登录-django

问题描述

我正在为来自特定 django 组的用户登录而苦苦挣扎，不幸的是，任何组用户都可以在不知道他是否属于某个组的情况下登录。

def loginstaff(request):
if not request.user.is_authenticated:
    if request.method == "POST":
        fm= AuthenticationForm(request=request, data=request.POST)
        if fm.is_valid():
            uname= fm.cleaned_data['username']
            upass= fm.cleaned_data['password']
            User = authenticate(username=uname,password=upass)
            if User is not None:
                login(request,User)
                messages.success(request,'Logged in Successfully..!')
                return HttpResponseRedirect('/staffprofile/')
    else:
        fm=AuthenticationForm()
    return render(request,'loginstaff.html',{'form':fm})
else:
    return HttpResponseRedirect('/staffprofile/')

我只创建了两个组。

帮助我的代码家伙，但简而言之:) bcz 我只是在学习。谢谢

标签： pythonpython-3.xdjangodjango-viewsdjango-forms

解决方案

你可以这样做

假设您的组名（您创建的）是“ writer ”，例如：

def loginstaff(request):
  if not request.user.is_authenticated:
    # get all the users of the group writer
    users_in_group = Group.objects.get(name="writer").user_set.all()
    # only if that user is a part the group
    if request.method == "POST" and request.user in users_in_group :
    ... #the rest of your function here

嘿，谢谢你，它很有效:)，但我做了一点改变

def loginstaff(request):
if not request.user.is_authenticated:
    users_in_group = Group.objects.get(name="STAFF").user_set.all()
    if request.method == "POST" :
        fm= AuthenticationForm(request=request, data=request.POST)
        if fm.is_valid():
            uname= fm.cleaned_data['username']
            upass= fm.cleaned_data['password']
            User = authenticate(username=uname,password=upass)
            if User is not None:
                **#I put this line here :)**
                if  User in users_in_group :
                    login(request,User)
                    messages.success(request,'Logged in Successfully..!')
                    return HttpResponseRedirect('/staffprofile/')

再次，谢谢你 ：）

推荐阅读