Template permission checks in Django - Mini Project: Build & Apply

Template Permission Checks in Django

📖 Scenario: You are building a simple Django web page that shows different messages based on user permissions. This is like a club where only members with certain badges can see special sections.

🎯 Goal: Create a Django template that checks if a user has specific permissions and shows messages accordingly.

📋 What You'll Learn

Create a Django context dictionary with a user and their permissions

Add a variable to represent a specific permission to check

Use Django template syntax to check if the user has that permission

Display a message in the template if the user has the permission

💡 Why This Matters

🌍 Real World

Web applications often need to show or hide parts of a page based on user permissions, like admin panels or special content.

💼 Career

Knowing how to check permissions in Django templates is essential for backend and full-stack developers working on secure web apps.

1

Create user permissions data

Create a dictionary called user_permissions with these exact keys and values: 'username': 'alice' and 'permissions': ['view_reports', 'edit_profile'].

Django

# Create the user_permissions dictionary with username and permissions list
# Your code here

Hint

Use a dictionary with keys 'username' and 'permissions'. The permissions value is a list of strings.

2

Add permission to check

Add a variable called required_permission and set it to the string 'view_reports'.

Django

user_permissions = {'username': 'alice', 'permissions': ['view_reports', 'edit_profile']}
# Add the required_permission variable below
# Your code here

Hint

Just create a string variable with the exact name and value.

3

Write template permission check

Write a Django template string called template_code that uses {% if required_permission in user_permissions.permissions %} to check permission and shows <p>Access granted to reports.</p> inside the if block.

Django

user_permissions = {'username': 'alice', 'permissions': ['view_reports', 'edit_profile']}
required_permission = 'view_reports'
# Write the Django template string with permission check below
# Your code here

Hint

Use triple quotes for the template string and the Django if tag with the exact variable names.

4

Complete template with else message

Extend the template_code string to add an {% else %} block that shows <p>Access denied.</p> when the user lacks the permission.

Django

user_permissions = {'username': 'alice', 'permissions': ['view_reports', 'edit_profile']}
required_permission = 'view_reports'
template_code = """{% if required_permission in user_permissions.permissions %}\nAccess granted to reports.\n{% endif %}"""
# Add an else block with access denied message inside template_code
# Your code here

Hint

Use the Django else tag inside the template string with the exact messages.

Practice

1. In a Django template, how do you check if a user has the permission to add an object from the app named blog?

easy

A. Use {% if perms.add_blog_object %}

B. Use {% if perms.blog.add_object_permission %}

C. Use {% if perms.blog.add %}

D. Use {% if perms.blog.add_object %}

Solution

1. Step 1: Understand Django permission naming

   Django permissions use the format app_label.permission_codename. For adding, the codename is usually add_modelname.

2. Step 2: Apply the correct syntax in template

   In templates, you check permissions with perms.app_label.permission_codename. So for adding an object in blog, it is perms.blog.add_object.

3. Final Answer:

   Use {% if perms.blog.add_object %} -> Option D

4. Quick Check:

   Permission check = perms.app_label.permission_codename [OK]

Hint: Use perms.app_label.permission_codename format for checks [OK]

Common Mistakes:

• Using incomplete permission codename
• Mixing app label and permission name order
• Adding extra words like '_permission'
• Using wrong variable names in template

2. Which of the following is the correct syntax to check if a user has permission change_post in the blog app inside a Django template?

easy

A. {% if user.has_perm('blog.change_post') %}

B. {% if perms.blog.change_post %}

C. {% if perms.change_post.blog %}

D. {% if perms.blog.change %}

Solution

1. Step 1: Recognize template permission check syntax

   In Django templates, permission checks use perms.app_label.permission_codename without calling methods.

2. Step 2: Match the permission codename correctly

   The permission codename is change_post and app label is blog, so the correct check is perms.blog.change_post.

3. Final Answer:

   {% if perms.blog.change_post %} -> Option B

4. Quick Check:

   Template permission check = perms.app_label.permission_codename [OK]

Hint: Use perms.app_label.permission_codename, no method calls [OK]

Common Mistakes:

• Trying to call has_perm() in template
• Swapping app label and permission codename
• Using incomplete permission names
• Using wrong syntax with dots misplaced

3. Given this Django template snippet:

{% if perms.shop.delete_product %}Delete allowed{% else %}No delete permission{% endif %}

What will be shown if the logged-in user does NOT have the delete_product permission in the shop app?

medium

A. No delete permission

B. Delete allowed

C. An error occurs

D. Nothing is shown

Solution

1. Step 1: Understand the if condition in template

   The template checks if the user has delete_product permission in shop app using perms.shop.delete_product.

2. Step 2: Evaluate the condition when permission is missing

   If the user lacks this permission, the condition is false, so the else block runs, showing No delete permission.

3. Final Answer:

   No delete permission -> Option A

4. Quick Check:

   Permission false shows else block text [OK]

Hint: If permission false, else block content shows [OK]

Common Mistakes:

• Assuming permission check throws error if false
• Expecting no output when else exists
• Confusing permission codename with app label
• Ignoring else block behavior

4. You wrote this Django template code:

{% if perms.blog.add_post %}Add Post{% endif %}

But the 'Add Post' button never appears, even for users with the permission. What is the most likely cause?

medium

A. The user is not authenticated, so perms is empty

B. You must use user.has_perm('blog.add_post') in templates

C. The permission codename is incorrect; it should be add_blog_post

D. The template tag {% if %} does not support permission checks

Solution

1. Step 1: Check permission codename format

   The permission codename add_post is correct for the post model in blog app.

2. Step 2: Consider user authentication state

   If the user is not logged in, perms will not contain permissions, so the check fails and content is hidden.

3. Final Answer:

   The user is not authenticated, so perms is empty -> Option A

4. Quick Check:

   Unauthenticated users have no perms data [OK]

Hint: Check if user is logged in; perms empty if not [OK]

Common Mistakes:

• Assuming wrong permission codename
• Trying to call has_perm() in template
• Believing template if tag can't check perms
• Ignoring user authentication status

5. You want to show a 'Delete' button only if the user has both delete_post permission in the blog app and delete_comment permission in the comments app. Which Django template code correctly implements this?

hard

A. {% if perms.blog.delete_post or perms.comments.delete_comment %}Delete{% endif %}

B. {% if perms.blog.delete_post && perms.comments.delete_comment %}Delete{% endif %}

C. {% if perms.blog.delete_post and perms.comments.delete_comment %}Delete{% endif %}

D. {% if perms.blog.delete_post and-or perms.comments.delete_comment %}Delete{% endif %}

Solution

1. Step 1: Understand logical operators in Django templates

   Django templates use Python-like syntax for logical operators: and, or, not symbols like &&.

2. Step 2: Combine permission checks correctly

   To require both permissions, use and between the two checks: perms.blog.delete_post and perms.comments.delete_comment.

3. Final Answer:

   {% if perms.blog.delete_post and perms.comments.delete_comment %}Delete{% endif %} -> Option C

4. Quick Check:

   Use 'and' for multiple permission checks [OK]

Hint: Use 'and' keyword to combine multiple permission checks [OK]

Common Mistakes:

• Using && instead of 'and' in template
• Using 'or' when both permissions are needed
• Using invalid operators like 'and-or'
• Forgetting to check both permissions