Template permission checks in Django

Introduction

Template permission checks help control what users see based on what they are allowed to do. This keeps your app safe and user-friendly.

Show or hide buttons depending on user roles.

Display special content only to logged-in users with certain rights.

Prevent users from seeing links to pages they cannot access.

Customize navigation menus based on user permissions.

Control form fields visibility depending on user access.

Syntax

Django

{% if perms.app_label.permission_codename %}
  <!-- content for users with permission -->
{% else %}
  <!-- content for others -->
{% endif %}

Use perms to check permissions in templates.

The format is perms.app_label.permission_codename, matching your Django app and permission.

Examples

Shows the 'Add Post' button only if the user has permission to add posts in the blog app.

Django

{% if perms.blog.add_post %}
  <button>Add Post</button>
{% endif %}

Shows an edit link if the user can change products; otherwise, shows a message.

Django

{% if perms.shop.change_product %}
  <a href="/edit-product/">Edit Product</a>
{% else %}
  <p>You cannot edit products.</p>
{% endif %}

Displays a welcome message only if the user has permission to view profiles.

Django

{% if perms.accounts.view_profile %}
  <p>Welcome back, valued user!</p>
{% endif %}

Sample Program

This template shows secret data only if the user has the view_secret_data permission in the app application. Otherwise, it shows a polite message.

Django

{# templates/example.html #}
<html lang="en">
<head>
  <title>Permission Check Example</title>
</head>
<body>
  <h1>Dashboard</h1>
  {% if perms.app.view_secret_data %}
    <p>Secret data: The launch code is 1234.</p>
  {% else %}
    <p>You do not have permission to see the secret data.</p>
  {% endif %}
</body>
</html>

Important Notes

Make sure your views pass the request context to templates so perms works.

Permission codenames are usually lowercase and use underscores.

You can combine permission checks with other template logic for more control.

Summary

Use perms.app_label.permission_codename in templates to check user permissions.

This helps show or hide content based on what users are allowed to do.

Always test permission checks to keep your app secure and user-friendly.

Practice

1. In a Django template, how do you check if a user has the permission to add an object from the app named blog?

easy

A. Use {% if perms.add_blog_object %}

B. Use {% if perms.blog.add_object_permission %}

C. Use {% if perms.blog.add %}

D. Use {% if perms.blog.add_object %}

Solution

1. Step 1: Understand Django permission naming

   Django permissions use the format app_label.permission_codename. For adding, the codename is usually add_modelname.

2. Step 2: Apply the correct syntax in template

   In templates, you check permissions with perms.app_label.permission_codename. So for adding an object in blog, it is perms.blog.add_object.

3. Final Answer:

   Use {% if perms.blog.add_object %} -> Option D

4. Quick Check:

   Permission check = perms.app_label.permission_codename [OK]

Hint: Use perms.app_label.permission_codename format for checks [OK]

Common Mistakes:

• Using incomplete permission codename
• Mixing app label and permission name order
• Adding extra words like '_permission'
• Using wrong variable names in template

2. Which of the following is the correct syntax to check if a user has permission change_post in the blog app inside a Django template?

easy

A. {% if user.has_perm('blog.change_post') %}

B. {% if perms.blog.change_post %}

C. {% if perms.change_post.blog %}

D. {% if perms.blog.change %}

Solution

1. Step 1: Recognize template permission check syntax

   In Django templates, permission checks use perms.app_label.permission_codename without calling methods.

2. Step 2: Match the permission codename correctly

   The permission codename is change_post and app label is blog, so the correct check is perms.blog.change_post.

3. Final Answer:

   {% if perms.blog.change_post %} -> Option B

4. Quick Check:

   Template permission check = perms.app_label.permission_codename [OK]

Hint: Use perms.app_label.permission_codename, no method calls [OK]

Common Mistakes:

• Trying to call has_perm() in template
• Swapping app label and permission codename
• Using incomplete permission names
• Using wrong syntax with dots misplaced

3. Given this Django template snippet:

{% if perms.shop.delete_product %}Delete allowed{% else %}No delete permission{% endif %}

What will be shown if the logged-in user does NOT have the delete_product permission in the shop app?

medium

A. No delete permission

B. Delete allowed

C. An error occurs

D. Nothing is shown

Solution

1. Step 1: Understand the if condition in template

   The template checks if the user has delete_product permission in shop app using perms.shop.delete_product.

2. Step 2: Evaluate the condition when permission is missing

   If the user lacks this permission, the condition is false, so the else block runs, showing No delete permission.

3. Final Answer:

   No delete permission -> Option A

4. Quick Check:

   Permission false shows else block text [OK]

Hint: If permission false, else block content shows [OK]

Common Mistakes:

• Assuming permission check throws error if false
• Expecting no output when else exists
• Confusing permission codename with app label
• Ignoring else block behavior

4. You wrote this Django template code:

{% if perms.blog.add_post %}Add Post{% endif %}

But the 'Add Post' button never appears, even for users with the permission. What is the most likely cause?

medium

A. The user is not authenticated, so perms is empty

B. You must use user.has_perm('blog.add_post') in templates

C. The permission codename is incorrect; it should be add_blog_post

D. The template tag {% if %} does not support permission checks

Solution

1. Step 1: Check permission codename format

   The permission codename add_post is correct for the post model in blog app.

2. Step 2: Consider user authentication state

   If the user is not logged in, perms will not contain permissions, so the check fails and content is hidden.

3. Final Answer:

   The user is not authenticated, so perms is empty -> Option A

4. Quick Check:

   Unauthenticated users have no perms data [OK]

Hint: Check if user is logged in; perms empty if not [OK]

Common Mistakes:

• Assuming wrong permission codename
• Trying to call has_perm() in template
• Believing template if tag can't check perms
• Ignoring user authentication status

5. You want to show a 'Delete' button only if the user has both delete_post permission in the blog app and delete_comment permission in the comments app. Which Django template code correctly implements this?

hard

A. {% if perms.blog.delete_post or perms.comments.delete_comment %}Delete{% endif %}

B. {% if perms.blog.delete_post && perms.comments.delete_comment %}Delete{% endif %}

C. {% if perms.blog.delete_post and perms.comments.delete_comment %}Delete{% endif %}

D. {% if perms.blog.delete_post and-or perms.comments.delete_comment %}Delete{% endif %}

Solution

1. Step 1: Understand logical operators in Django templates

   Django templates use Python-like syntax for logical operators: and, or, not symbols like &&.

2. Step 2: Combine permission checks correctly

   To require both permissions, use and between the two checks: perms.blog.delete_post and perms.comments.delete_comment.

3. Final Answer:

   {% if perms.blog.delete_post and perms.comments.delete_comment %}Delete{% endif %} -> Option C

4. Quick Check:

   Use 'and' for multiple permission checks [OK]

Hint: Use 'and' keyword to combine multiple permission checks [OK]

Common Mistakes:

• Using && instead of 'and' in template
• Using 'or' when both permissions are needed
• Using invalid operators like 'and-or'
• Forgetting to check both permissions