Template permission checks in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What will this Django template render?

Given the following Django template snippet, what will be rendered if the user has the 'app.view_item' permission?

{% if perms.app.view_item %}You can view this item.{% else %}Access denied.{% endif %}

Django

{% if perms.app.view_item %}You can view this item.{% else %}Access denied.{% endif %}

A You can view this item.

B Access denied.

C An error occurs because 'perms' is undefined.

D Nothing is rendered.

💡 Hint

The 'perms' variable in Django templates checks user permissions.

The 'perms' context variable allows checking if the user has a specific permission. If the user has 'app.view_item', the first block renders.

📝 Syntax

intermediate

Identify the syntax error in this permission check

What is wrong with this Django template code?

{% if perms.app.view_item == True %}Allowed{% else %}Denied{% endif %}

Django

{% if perms.app.view_item == True %}Allowed{% else %}Denied{% endif %}

A The comparison '== True' is unnecessary and causes a syntax error.

B The 'perms' variable cannot be used in templates.

C The 'else' tag is missing a colon.

D The template tag should be {% if perms.app.view_item %} without '== True'.

💡 Hint

Django template if tags do not require explicit boolean comparisons.

In Django templates, 'perms.app.view_item' already evaluates to True or False. Using '== True' is not a syntax error but unnecessary. The correct style is without '== True'.

🔧 Debug

advanced

Why does this permission check always fail?

Consider this Django template snippet:

{% if perms.app.view_item %}Show{% else %}Hide{% endif %}

The user has the permission 'app.view_item', but the template always renders 'Hide'. Why?

Django

{% if perms.app.view_item %}Show{% else %}Hide{% endif %}

A The user object is not passed to the template context, so 'perms' is empty.

B The permission name is incorrect; it should be 'app.viewitems'.

C The template tag syntax is invalid and causes the condition to always be false.

D The user is anonymous, so no permissions are granted.

💡 Hint

Check if the user context is available in the template.

If the user is not passed to the template context or the authentication context processor is missing, 'perms' will not have permission info, causing the check to fail.

❓ state_output

advanced

What is the output of this permission loop?

Given this Django template code:

{% for perm in perms.app %}{{ perm }} {% endfor %}

What will be the output if the user has permissions 'app.view_item' and 'app.change_item'?

Django

{% for perm in perms.app %}{{ perm }} {% endfor %}

A Outputs 'view_item change_item '

B Outputs nothing because 'perms.app' is empty.

C Raises an error because 'perms.app' is not iterable.

D Outputs 'app.view_item app.change_item '

💡 Hint

'perms.app' is not a list but a permission checker object.

'perms.app' is not iterable in Django templates. It is a special object to check permissions, so looping over it causes an error.

🧠 Conceptual

expert

Which template code correctly checks multiple permissions?

You want to show a message only if the user has both 'app.view_item' and 'app.change_item' permissions. Which Django template snippet does this correctly?

A {% if perms.app.view_item %}{% if perms.app.change_item %}Allowed{% else %}Denied{% endif %}{% else %}Denied{% endif %}

B {% if perms.app.view_item and perms.app.change_item %}Allowed{% else %}Denied{% endif %}

C {% if perms.app.view_item or perms.app.change_item %}Allowed{% else %}Denied{% endif %}

D {% if perms.app.view_item & perms.app.change_item %}Allowed{% else %}Denied{% endif %}

💡 Hint

Use 'and' to combine conditions in Django templates.

Django templates support 'and' for combining conditions. Option B uses 'and' correctly. Option B is nested but more complex. Option B uses 'or' which is incorrect. Option B uses '&' which is invalid in templates.

Practice

1. In a Django template, how do you check if a user has the permission to add an object from the app named blog?

easy

A. Use {% if perms.add_blog_object %}

B. Use {% if perms.blog.add_object_permission %}

C. Use {% if perms.blog.add %}

D. Use {% if perms.blog.add_object %}

Solution

1. Step 1: Understand Django permission naming

   Django permissions use the format app_label.permission_codename. For adding, the codename is usually add_modelname.

2. Step 2: Apply the correct syntax in template

   In templates, you check permissions with perms.app_label.permission_codename. So for adding an object in blog, it is perms.blog.add_object.

3. Final Answer:

   Use {% if perms.blog.add_object %} -> Option D

4. Quick Check:

   Permission check = perms.app_label.permission_codename [OK]

Hint: Use perms.app_label.permission_codename format for checks [OK]

Common Mistakes:

• Using incomplete permission codename
• Mixing app label and permission name order
• Adding extra words like '_permission'
• Using wrong variable names in template

2. Which of the following is the correct syntax to check if a user has permission change_post in the blog app inside a Django template?

easy

A. {% if user.has_perm('blog.change_post') %}

B. {% if perms.blog.change_post %}

C. {% if perms.change_post.blog %}

D. {% if perms.blog.change %}

Solution

1. Step 1: Recognize template permission check syntax

   In Django templates, permission checks use perms.app_label.permission_codename without calling methods.

2. Step 2: Match the permission codename correctly

   The permission codename is change_post and app label is blog, so the correct check is perms.blog.change_post.

3. Final Answer:

   {% if perms.blog.change_post %} -> Option B

4. Quick Check:

   Template permission check = perms.app_label.permission_codename [OK]

Hint: Use perms.app_label.permission_codename, no method calls [OK]

Common Mistakes:

• Trying to call has_perm() in template
• Swapping app label and permission codename
• Using incomplete permission names
• Using wrong syntax with dots misplaced

3. Given this Django template snippet:

{% if perms.shop.delete_product %}Delete allowed{% else %}No delete permission{% endif %}

What will be shown if the logged-in user does NOT have the delete_product permission in the shop app?

medium

A. No delete permission

B. Delete allowed

C. An error occurs

D. Nothing is shown

Solution

1. Step 1: Understand the if condition in template

   The template checks if the user has delete_product permission in shop app using perms.shop.delete_product.

2. Step 2: Evaluate the condition when permission is missing

   If the user lacks this permission, the condition is false, so the else block runs, showing No delete permission.

3. Final Answer:

   No delete permission -> Option A

4. Quick Check:

   Permission false shows else block text [OK]

Hint: If permission false, else block content shows [OK]

Common Mistakes:

• Assuming permission check throws error if false
• Expecting no output when else exists
• Confusing permission codename with app label
• Ignoring else block behavior

4. You wrote this Django template code:

{% if perms.blog.add_post %}Add Post{% endif %}

But the 'Add Post' button never appears, even for users with the permission. What is the most likely cause?

medium

A. The user is not authenticated, so perms is empty

B. You must use user.has_perm('blog.add_post') in templates

C. The permission codename is incorrect; it should be add_blog_post

D. The template tag {% if %} does not support permission checks

Solution

1. Step 1: Check permission codename format

   The permission codename add_post is correct for the post model in blog app.

2. Step 2: Consider user authentication state

   If the user is not logged in, perms will not contain permissions, so the check fails and content is hidden.

3. Final Answer:

   The user is not authenticated, so perms is empty -> Option A

4. Quick Check:

   Unauthenticated users have no perms data [OK]

Hint: Check if user is logged in; perms empty if not [OK]

Common Mistakes:

• Assuming wrong permission codename
• Trying to call has_perm() in template
• Believing template if tag can't check perms
• Ignoring user authentication status

5. You want to show a 'Delete' button only if the user has both delete_post permission in the blog app and delete_comment permission in the comments app. Which Django template code correctly implements this?

hard

A. {% if perms.blog.delete_post or perms.comments.delete_comment %}Delete{% endif %}

B. {% if perms.blog.delete_post && perms.comments.delete_comment %}Delete{% endif %}

C. {% if perms.blog.delete_post and perms.comments.delete_comment %}Delete{% endif %}

D. {% if perms.blog.delete_post and-or perms.comments.delete_comment %}Delete{% endif %}

Solution

1. Step 1: Understand logical operators in Django templates

   Django templates use Python-like syntax for logical operators: and, or, not symbols like &&.

2. Step 2: Combine permission checks correctly

   To require both permissions, use and between the two checks: perms.blog.delete_post and perms.comments.delete_comment.

3. Final Answer:

   {% if perms.blog.delete_post and perms.comments.delete_comment %}Delete{% endif %} -> Option C

4. Quick Check:

   Use 'and' for multiple permission checks [OK]

Hint: Use 'and' keyword to combine multiple permission checks [OK]

Common Mistakes:

• Using && instead of 'and' in template
• Using 'or' when both permissions are needed
• Using invalid operators like 'and-or'
• Forgetting to check both permissions