Template permission checks in Django - Step-by-Step Execution

Concept Flow - Template permission checks

User Request

↓

View Fetches User

↓

View Passes User to Template

↓

Template Receives User

↓

Template Checks Permissions

↓

Has Permission

↓

Show Content

The flow shows how a Django template receives a user object and checks permissions to decide what content to show.

Execution Sample

Django

{% if user.has_perm 'app.view_item' %}
  <p>Secret content here</p>
{% else %}
  <p>Access denied</p>
{% endif %}

This template code checks if the user has a specific permission and shows content accordingly.

Execution Table

Step	Template Line	Condition Checked	Result	Content Rendered
1	{% if user.has_perm 'app.view_item' %}	user.has_perm('app.view_item')	True	<p>Secret content here</p>
2	{% else %}	N/A	Skipped	N/A
3	{% endif %}	N/A	End if	N/A
4	Render complete	N/A	N/A	Secret content shown

💡 Permission check passed, so secret content is rendered and else block skipped.

Variable Tracker

Variable	Start	After Step 1	Final
user.has_perm('app.view_item')	Unknown	True	True

Key Moments - 2 Insights

Why does the template use user.has_perm instead of checking permissions in the view?

The template can directly check permissions to decide what to show, making the UI responsive to user rights without extra view logic. See execution_table step 1 where the condition is evaluated.

What happens if the user does not have the permission?

The else block runs, showing alternative content. This is shown in execution_table step 2 where else is skipped if permission is true, but would run if false.

Visual Quiz - 3 Questions

Look at the execution table, what content is rendered when user.has_perm returns True?

A <p>Access denied</p>

B <p>Secret content here</p>

C Nothing is rendered

D Both contents are rendered

💡 Hint

Check execution_table row 1 under Content Rendered.

At which step does the template decide to skip the else block?

A Step 2

B Step 1

C Step 3

D Step 4

💡 Hint

Look at execution_table step 2 where else is marked as skipped.

If user.has_perm returned False, what would change in the execution table?

A No content would be rendered

B Step 1 result would be True and secret content rendered

C Step 1 result would be False and else block content rendered

D Template would error out

💡 Hint

Refer to variable_tracker and execution_table step 1 and 2 for permission check results.

Concept Snapshot

Django templates can check user permissions using {% if user.has_perm 'app.permission' %}.
If True, show protected content.
Else, show alternative or nothing.
This keeps permission logic simple and UI responsive.
Always pass user to template context.

Full Transcript

In Django, templates can check user permissions directly using the user.has_perm method. When a view passes the user object to the template, the template uses an if statement to check if the user has a specific permission. If the permission check returns true, the template renders the protected content. Otherwise, it renders an alternative message or hides the content. This approach allows the UI to adapt based on user rights without extra logic in the view. The execution table shows the step-by-step evaluation of the permission check and which content is rendered. The variable tracker follows the permission check result. Key moments clarify why permission checks happen in the template and what happens when permissions are missing. The visual quiz tests understanding of the permission check flow and rendering decisions.

Practice

1. In a Django template, how do you check if a user has the permission to add an object from the app named blog?

easy

A. Use {% if perms.add_blog_object %}

B. Use {% if perms.blog.add_object_permission %}

C. Use {% if perms.blog.add %}

D. Use {% if perms.blog.add_object %}

Solution

1. Step 1: Understand Django permission naming

   Django permissions use the format app_label.permission_codename. For adding, the codename is usually add_modelname.

2. Step 2: Apply the correct syntax in template

   In templates, you check permissions with perms.app_label.permission_codename. So for adding an object in blog, it is perms.blog.add_object.

3. Final Answer:

   Use {% if perms.blog.add_object %} -> Option D

4. Quick Check:

   Permission check = perms.app_label.permission_codename [OK]

Hint: Use perms.app_label.permission_codename format for checks [OK]

Common Mistakes:

• Using incomplete permission codename
• Mixing app label and permission name order
• Adding extra words like '_permission'
• Using wrong variable names in template

2. Which of the following is the correct syntax to check if a user has permission change_post in the blog app inside a Django template?

easy

A. {% if user.has_perm('blog.change_post') %}

B. {% if perms.blog.change_post %}

C. {% if perms.change_post.blog %}

D. {% if perms.blog.change %}

Solution

1. Step 1: Recognize template permission check syntax

   In Django templates, permission checks use perms.app_label.permission_codename without calling methods.

2. Step 2: Match the permission codename correctly

   The permission codename is change_post and app label is blog, so the correct check is perms.blog.change_post.

3. Final Answer:

   {% if perms.blog.change_post %} -> Option B

4. Quick Check:

   Template permission check = perms.app_label.permission_codename [OK]

Hint: Use perms.app_label.permission_codename, no method calls [OK]

Common Mistakes:

• Trying to call has_perm() in template
• Swapping app label and permission codename
• Using incomplete permission names
• Using wrong syntax with dots misplaced

3. Given this Django template snippet:

{% if perms.shop.delete_product %}Delete allowed{% else %}No delete permission{% endif %}

What will be shown if the logged-in user does NOT have the delete_product permission in the shop app?

medium

A. No delete permission

B. Delete allowed

C. An error occurs

D. Nothing is shown

Solution

1. Step 1: Understand the if condition in template

   The template checks if the user has delete_product permission in shop app using perms.shop.delete_product.

2. Step 2: Evaluate the condition when permission is missing

   If the user lacks this permission, the condition is false, so the else block runs, showing No delete permission.

3. Final Answer:

   No delete permission -> Option A

4. Quick Check:

   Permission false shows else block text [OK]

Hint: If permission false, else block content shows [OK]

Common Mistakes:

• Assuming permission check throws error if false
• Expecting no output when else exists
• Confusing permission codename with app label
• Ignoring else block behavior

4. You wrote this Django template code:

{% if perms.blog.add_post %}Add Post{% endif %}

But the 'Add Post' button never appears, even for users with the permission. What is the most likely cause?

medium

A. The user is not authenticated, so perms is empty

B. You must use user.has_perm('blog.add_post') in templates

C. The permission codename is incorrect; it should be add_blog_post

D. The template tag {% if %} does not support permission checks

Solution

1. Step 1: Check permission codename format

   The permission codename add_post is correct for the post model in blog app.

2. Step 2: Consider user authentication state

   If the user is not logged in, perms will not contain permissions, so the check fails and content is hidden.

3. Final Answer:

   The user is not authenticated, so perms is empty -> Option A

4. Quick Check:

   Unauthenticated users have no perms data [OK]

Hint: Check if user is logged in; perms empty if not [OK]

Common Mistakes:

• Assuming wrong permission codename
• Trying to call has_perm() in template
• Believing template if tag can't check perms
• Ignoring user authentication status

5. You want to show a 'Delete' button only if the user has both delete_post permission in the blog app and delete_comment permission in the comments app. Which Django template code correctly implements this?

hard

A. {% if perms.blog.delete_post or perms.comments.delete_comment %}Delete{% endif %}

B. {% if perms.blog.delete_post && perms.comments.delete_comment %}Delete{% endif %}

C. {% if perms.blog.delete_post and perms.comments.delete_comment %}Delete{% endif %}

D. {% if perms.blog.delete_post and-or perms.comments.delete_comment %}Delete{% endif %}

Solution

1. Step 1: Understand logical operators in Django templates

   Django templates use Python-like syntax for logical operators: and, or, not symbols like &&.

2. Step 2: Combine permission checks correctly

   To require both permissions, use and between the two checks: perms.blog.delete_post and perms.comments.delete_comment.

3. Final Answer:

   {% if perms.blog.delete_post and perms.comments.delete_comment %}Delete{% endif %} -> Option C

4. Quick Check:

   Use 'and' for multiple permission checks [OK]

Hint: Use 'and' keyword to combine multiple permission checks [OK]

Common Mistakes:

• Using && instead of 'and' in template
• Using 'or' when both permissions are needed
• Using invalid operators like 'and-or'
• Forgetting to check both permissions