django-ya-model-publisher 0.6.8

Features

• Django CMS page support.

• Add request/reject buttons in Django CMS toolbar.

• Django CMS placeholders support.

• Hvad/Parler support.

• Restrict user access to publish functions with user permissions.

base info

We have these three user types:

• A user with only a few rights (we call it ‘reporter’)

• A user with more rights (We call it ‘editor’)

• The superuser with all rights

The user case is following:

• ‘reporter’:

  • can only change draft content

  • can’t change public content

  • can’t delete publisher model entries or CMS pages.

  • can send a (un-)publish request to the ‘editor’ with a text node.

• ‘editor’:

  • can response open publishing request from ‘reporter’.

  • can change drafts and public content, but only if there is no pending request.

  • can delete publisher model entries or CMS pages.

  • can’t delete/manipulate publisher state model entries.

permissions

Permissions for ‘reporter’ who can only create (un-)publish requests:

...
[ ] cms.publish_page
...
[*] cms.add_page
[*] cms.change_page
[ ] cms.delete_page
...
[ ] publisher.add_publisherstatemodel
[*] publisher.change_publisherstatemodel
[ ] publisher.delete_publisherstatemodel
...
[ ] <app_name>.can_publish_<model_name>
...
[*] <app_name>.add_<model_name>
[*] <app_name>.change_<model_name>
[ ] <app_name>.delete_<model_name>
...

Permissions for ‘editor’ who can accept/reject (un-)publish requests:

...
[*] cms.publish_page
...
[*] cms.add_page
[*] cms.change_page
[*] cms.delete_page
...
[ ] publisher.add_publisherstatemodel
[*] publisher.change_publisherstatemodel
[ ] publisher.delete_publisherstatemodel
...
[*] <app_name>.can_publish_<model_name>
...
[*] <app_name>.add_<model_name>
[*] <app_name>.change_<model_name>
[*] <app_name>.delete_<model_name>
...

Important: To prevent a privilege escalation, both users must not have access to these models:

• django.contrib.auth.models.Permission

• django.contrib.auth.models.Group

• cms.models.PagePermission

Test users:

See user permission tests in:

• publisher_tests.test_basics.PermissionTestCase

Primary key type compatibility

The publisher.models.PublisherStateModel used a PositiveIntegerField for the GenericForeignKey so it can only be used for models with a integer primary keys! See also: https://docs.djangoproject.com/en/1.11/ref/contrib/contenttypes/#django.contrib.contenttypes.fields.GenericForeignKey

Django compatibility

Note: See travis/tox config files for current test matrix

Currently Django CMS v3.5 is not supported, yet. It’s on the TODO, see: issues #10

run tests

run tests via py.test with current python/environment:

$ make test
or
$ ./setup.py test
or
$ python tests/manage.py test myapp

run test via tox e.g.:

$ make tox
or
$ ./setup.py tox
or
$ tox

$ ./run_test_project_dev_server.sh

$ ./publisher_test_project/manage.py run_test_project_dev_server

$ ./run_test_project_dev_server.sh --help
...
usage: manage.py run_test_project_dev_server [-h] [--version] [-v {0,1,2,3}]
                                             [--settings SETTINGS]
                                             [--pythonpath PYTHONPATH]
                                             [--traceback] [--no-color]
                                             [--ipv6] [--nothreading]
                                             [--noreload] [--nostatic]
                                             [--insecure]
                                             [addrport]
...

$ ./publisher_test_project/manage.py create_test_data --fresh

$ rm publisher_test_project/publisher_test_database.sqlite3

Backwards-incompatible changes

v0.6.0

The permission names changed! Please update your django user permissions, too.

These permissions are removed:

• direct_publisher

• ask_publisher_request

• reply_publisher_request

Please read the information above.

history

• dev compare v0.6.8…master

• v0.6.8 - 01.02.2018 - compare v0.6.7…v0.6.8

  • Fix #9 Redirect after “request publishing”

  • Add reply/history Links in Django CMS Toolbar (specially for page with pending requests)

• v0.6.7 - 31.01.2018 - compare v0.6.6…v0.6.7

  • NEW: ‘History’ view in admin (e.g.: see status/history of closed request and status for users that can only create requests)

  • No 404 when “reply” closed requests or deleted instance.

• v0.6.6 - 30.01.2018 - compare v0.6.5…v0.6.6

  • Bugfix: redirect after “Request publishing” can result in a 404, see: issues #9

• v0.6.5 - 30.01.2018 - compare v0.6.4…v0.6.5

  • Bugfix: Missing “Request publishing” toobar link on new created pages

  • Add username list on test pages

• v0.6.4 - 29.01.2018 - compare v0.6.3…v0.6.4

  • Hide PublisherStateModel admin actions for all non-superusers

• v0.6.3 - 26.01.2018 - compare v0.6.2…v0.6.3

  • Security Fix: User without ‘can_publish’ permission can accept/reject requests.

  • Hide ‘change’ PublisherStateModel admin view for all non-superusers

  • Disable ‘add’ PublisherStateModel admin view for all users

• v0.6.2 - 02.01.2018 - compare v0.6.1…v0.6.2

  • Handle publishes states with deletes instance: Add a admin view to close the request.

  • Bugfix: deny editing pending request objects

  • Create messages after (un-)/publish request created.

• v0.6.1 - 28.12.2017 - compare v0.6.0…v0.6.1

  • remove own “unique_together”: Add "publisher_is_draft" to your own “unique_together” tuple

  • remove out dated manage command “update_permissions” (can be found in django-tools)

• v0.6.0 - 27.12.2017 - compare v0.5.1…v0.6.0

  • refactor permissions and publisher workflow

  • NEW: publisher.views.PublisherCmsViewMixin

  • NEW: publisher.admin.VisibilityMixin

  • bugfix django v1.11 compatibility

  • Expand tests with publisher_test_project.publisher_list_app

• v0.5.1 - 20.12.2017 - compare v0.5.0…v0.5.1

  • fix python package (add missing parts)

  • change travis/tox/pytest configuration

  • minor code update

• v0.5.0 - 19.12.2017 - compare v0.4.1…v0.5.0

  • Skip official support for python v2.7 and v3.4 (remove from text matrix)

  • Implement “request/reject/accept publishing” workflow with a shot messages and logging

  • Add “request/reject/accept publishing” buttons to Django CMS toolbar for cms pages.

• v0.4.1 - 14.11.2017 - compare v0.4.0.dev1…v0.4.1

  • Refactor test run setup

  • bugfix project name

• v0.4.0.dev1 - 14.11.2017 - compare v0.3.1…v0.4.0.dev1

  • Just create the fork and apply all pull requests from andersinno/django-model-publisher-ai/pull/14

links

donation

• paypal.me/JensDiemer

• Flattr This!

• Send Bitcoins to 1823RZ5Md1Q2X5aSXRC5LRPcYdveCiVX6F