Object-level permissions concept in Django - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to check if a user has permission for a specific object.

Django

if request.user.has_perm('[1]', obj):
    # Allow access
    pass

Drag options to blanks, or click blank then click option'

Aapp.delete_model

Bapp.change_model

Capp.view_model

Dapp.add_model

Attempts:

3 left

💡 Hint

Common Mistakes

Using a permission without the app label prefix.

Checking permissions without passing the object for object-level checks.

The has_perm method checks if the user has the specified permission for the given object. Here, app.view_model is the permission to view the object.

2fill in blank

medium

Complete the code to assign object-level permission to a user.

Django

from guardian.shortcuts import assign_perm
assign_perm('[1]', user, obj)

Drag options to blanks, or click blank then click option'

Aapp.change_model

Bapp.view_model

Capp.delete_model

Dapp.add_model

Attempts:

3 left

💡 Hint

Common Mistakes

Not importing assign_perm from django-guardian.

Assigning permissions without specifying the object.

The assign_perm function from django-guardian assigns a permission to a user for a specific object. Here, app.change_model grants change permission.

3fill in blank

hard

Fix the error in the code to check object-level permission correctly.

Django

if user.has_perm('[1]'):
    # Access granted
    pass

Drag options to blanks, or click blank then click option'

Aapp.view_model, obj

Bapp.view_model

Capp.change_model

Dapp.delete_model

Attempts:

3 left

💡 Hint

Common Mistakes

Calling has_perm without the object argument for object-level permissions.

Passing the object inside the permission string.

For object-level permission checks, has_perm requires the permission string and the object as the second argument. Passing only the permission string checks global permission.

4fill in blank

hard

Fill both blanks to filter objects a user has view permission for.

Django

from guardian.shortcuts import get_objects_for_user
objects = get_objects_for_user(user, '[1]', [2]=Model)

Drag options to blanks, or click blank then click option'

Aapp.view_model

BModel

Cklass

Dobj

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect keyword argument instead of klass.

Passing an object instance instead of the model class.

get_objects_for_user returns objects of a model for which the user has the specified permission. The permission string and the model class are required arguments.

5fill in blank

hard

Fill all three blanks to remove a user's object-level permission.

Django

from guardian.shortcuts import remove_perm
remove_perm('[1]', [2], [3])

Drag options to blanks, or click blank then click option'

Aapp.change_model

Buser

Cobj

Drequest.user

Attempts:

3 left

💡 Hint

Common Mistakes

Passing the wrong user variable like request.user when user is expected.

Not passing the object instance as the third argument.

The remove_perm function removes a specific permission from a user for a given object. You need to provide the permission string, the user, and the object.