django-guardian 3.5.2

on Python PyPI

Bug fixes

• get_objects_for_group honoured global permissions from other models (#1046, #1059). The group's global permissions were matched by codename only, without the content type. A group with a global permission on one model got every object of any other model with the same codename, e.g. blog.view_post granted access to all forum.Post objects, or a custom can_publish defined on two models. Global permissions are now filtered by the queried model's content type.
• get_40x_or_None ignored any_perm in the global permission check (#1048, #1058). With accept_global_perms=True and any_perm=True, a user holding only one of the required permissions globally was denied. The global check now uses any() when any_perm is set. This affects PermissionRequiredMixin. The permission_required decorators check a single permission and are not affected.
• get_perms() returned no permissions for superusers with GUARDIAN_AUTO_PREFETCH (#1049, #1056). ObjectPermissionChecker.get_perms() returned [], or only explicitly assigned permissions, for an active superuser, while has_perm() returned True. Superusers now get every permission for the object's content type, the same as with AUTO_PREFETCH off. The get_perms() shortcut and the get_obj_perms template tag are fixed too.
• Batched clean_orphan_obj_perms skipped rows (#1045, #1057). With batch_size set, deleting orphans shifted the remaining rows, so the next batch skipped as many rows as were just deleted. The last group batch could also be missed when the user permissions ended in a partial batch. Batches now continue from the last seen primary key, and the logged resume hint no longer skips rows.
• The backend ignored GUARDIAN_ANONYMOUS_USER_CACHE_TTL (#1050, #1054). ObjectPermissionBackend looked up the anonymous user with its own query, so every anonymous has_perm() / get_all_permissions() call hit the database. It now uses get_anonymous_user(), which applies the cache.

⚠️ Behaviour changes

These fixes can change results for existing code:

• get_objects_for_group(..., accept_global_perms=True) may return fewer objects. This happens when a group's global permission was on a different model with the same codename. If objects disappear, grant the global permission on the model you are querying.
• PermissionRequiredMixin with any_perm=True and accept_global_perms=True may now allow requests it used to deny. A user who holds any one of the required permissions globally now gets access. Check that this is what you intended for those views.
• With GUARDIAN_AUTO_PREFETCH = True, get_perms() and {% get_obj_perms %} return the full permission list for superusers. Templates or code that branch on this list will now show superusers everything.
• Batched clean_orphan_obj_perms may remove more orphans than before, because it no longer skips rows. Don't reuse a skip_batches value logged by an older version. Rerun the cleanup from the start instead.

What's Changed

• Return all permissions for superusers in get_perms() with AUTO_PREFETCH by @wang2-lat in #1056
• Scope the global permissions of get_objects_for_group to the queried model by @Anikesh0001 in #1059
• Honor any_perm in the global permission check of get_40x_or_None by @Anikesh0001 in #1058
• Fix batched clean_orphan_obj_perms skipping rows after deleting orphans by @Anikesh0001 in #1057
• Use get_anonymous_user() in the backend's anonymous user lookup by @kayaal34 in #1054
• Bump version to 3.5.2 by @Natgho in #1060

New Contributors

• @wang2-lat made their first contribution in #1056
• @Anikesh0001 made their first contribution in #1059
• @kayaal34 made their first contribution in #1054

Full Changelog: 3.5.1...3.5.2