如何限制对 Django 中管理页面的访问?
问题描述
我需要只有超级用户和工作人员在制作时才能访问 Django 管理界面,并显示所有其他类型的用户(包括未登录时)的 404.这可能吗?如何实现?
I need the Django admin interface to be accessible only for superusers and staff when in productions and show a 404 of all other types of users including when not logged in. Is this possible and how?
解决方案
我最终为它写了一个中间件:
I ended up writing a middleware for it:
from django.core.urlresolvers import reverse
from django.http import Http404
class RestrictStaffToAdminMiddleware(object):
"""
A middleware that restricts staff members access to administration panels.
"""
def process_request(self, request):
if request.path.startswith(reverse('admin:index')):
if request.user.is_authenticated():
if not request.user.is_staff:
raise Http404
else:
raise Http404
相关文章