Only staff with good permission mask can visit Django Admin

apps/permission/admin.py

@@ -3,10 +3,11 @@
 
 from django.contrib import admin
 
+from note_kfet.admin import admin_site
 from .models import Permission, PermissionMask, Role
 
 
-@admin.register(PermissionMask)
+@admin.register(PermissionMask, site=admin_site)
 class PermissionMaskAdmin(admin.ModelAdmin):
     """
     Admin customisation for PermissionMask
@@ -14,7 +15,7 @@ class PermissionMaskAdmin(admin.ModelAdmin):
     list_display = ('description', 'rank', )
 
 
-@admin.register(Permission)
+@admin.register(Permission, site=admin_site)
 class PermissionAdmin(admin.ModelAdmin):
     """
     Admin customisation for Permission
@@ -22,7 +23,7 @@ class PermissionAdmin(admin.ModelAdmin):
     list_display = ('type', 'model', 'field', 'mask', 'description', )
 
 
-@admin.register(Role)
+@admin.register(Role, site=admin_site)
 class RoleAdmin(admin.ModelAdmin):
     """
     Admin customisation for Role

apps/permission/backends.py

@@ -42,7 +42,7 @@ class PermissionBackend(ModelBackend):
 
         for membership in memberships:
             for role in membership.roles.all():
-                for perm in role.permissions.filter(type=t, mask__rank__lte=get_current_session().get("permission_mask", 42)).all():
+                for perm in role.permissions.filter(type=t, mask__rank__lte=get_current_session().get("permission_mask", -1)).all():
                     if not perm.permanent:
                         if membership.date_start > timezone.now().date() or membership.date_end < timezone.now().date():
                             continue
@@ -101,7 +101,7 @@ class PermissionBackend(ModelBackend):
             # Anonymous users can't do anything
             return Q(pk=-1)
 
-        if user.is_superuser and get_current_session().get("permission_mask", 42) >= 42:
+        if user.is_superuser and get_current_session().get("permission_mask", -1) >= 42:
             # Superusers have all rights
             return Q()
 
@@ -137,7 +137,7 @@ class PermissionBackend(ModelBackend):
         if sess is not None and sess.session_key is None:
             return False
 
-        if user_obj.is_superuser and get_current_session().get("permission_mask", 42) >= 42:
+        if user_obj.is_superuser and get_current_session().get("permission_mask", -1) >= 42:
             return True
 
         if obj is None:

apps/permission/templatetags/perms.py

@@ -1,6 +1,7 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from django.contrib.auth.models import AnonymousUser
 from django.contrib.contenttypes.models import ContentType
 from django.template.defaultfilters import stringfilter
 from django import template
@@ -16,9 +17,9 @@ def not_empty_model_list(model_name):
     """
     user = get_current_authenticated_user()
     session = get_current_session()
-    if user is None:
+    if user is None or isinstance(user, AnonymousUser):
         return False
-    elif user.is_superuser and session.get("permission_mask", 0) >= 42:
+    elif user.is_superuser and session.get("permission_mask", -1) >= 42:
         return True
     qs = model_list(model_name)
     return qs.exists()
@@ -31,9 +32,9 @@ def not_empty_model_change_list(model_name):
     """
     user = get_current_authenticated_user()
     session = get_current_session()
-    if user is None:
+    if user is None or isinstance(user, AnonymousUser):
         return False
-    elif user.is_superuser and session.get("permission_mask", 0) >= 42:
+    elif user.is_superuser and session.get("permission_mask", -1) >= 42:
         return True
     qs = model_list(model_name, "change")
     return qs.exists()
@@ -45,11 +46,11 @@ def model_list(model_name, t="view", fetch=True):
     Return the queryset of all visible instances of the given model.
     """
     user = get_current_authenticated_user()
-    if user is None:
-        return False
     spl = model_name.split(".")
     ct = ContentType.objects.get(app_label=spl[0], model=spl[1])
     qs = ct.model_class().objects.filter(PermissionBackend.filter_queryset(user, ct, t))
+    if user is None or isinstance(user, AnonymousUser):
+        return qs.none()
     if fetch:
         qs = qs.all()
     return qs
@@ -73,9 +74,9 @@ def can_create_transaction():
     """
     user = get_current_authenticated_user()
     session = get_current_session()
-    if user is None:
+    if user is None or isinstance(user, AnonymousUser):
         return False
-    elif user.is_superuser and session.get("permission_mask", 0) >= 42:
+    elif user.is_superuser and session.get("permission_mask", -1) >= 42:
         return True
     if session.get("can_create_transaction", None):
         return session.get("can_create_transaction", None) == 1