限制仅对 is_superuser 的访问。 is_staff 仍然可以访问页面

Question

我做错了什么？即使不是超级用户，is_staff 仍然可以访问此页面。你能在这里找到我的错误吗？

from django import forms
from django.conf import settings
from django.http import HttpResponse, HttpResponseRedirect, Http404
from ManagerApp import models as pmod
from . import templater
from django.contrib.auth.decorators import login_required
from django.contrib.auth.decorators import user_passes_test

@login_required(login_url='/ManagerApp/login/')
@user_passes_test(lambda u: u.is_superuser)

def process_request__new(request):
  q = pmod.User()
  q.first_name = 'New User!'
  q.save()
  return HttpResponseRedirect('/ManagerApp/edit_user/' + str(q.id))

def process_request(request):
  '''Shows all users in the DB'''
  q = pmod.User.objects.get(id=request.urlparams[0])
  form = UserForm(initial={
    #'active': q.is_active,
    'superuser': q.is_superuser,
    'staff': q.is_staff,
    'firstname': q.first_name,
    'lastname': q.last_name,
    'username': q.username,
    'password': q.password,
    'email': q.email,
    'street': q.street,
    'city': q.city,
    'state': q.state,
    'zipCode': q.zipcode,
    'phone': q.phone,
  })
  if request.method == 'POST':
    form = UserForm(request.POST)
    if form.is_valid():
      #q.is_active = form.cleaned_data['active']
      q.is_superuser = form.cleaned_data['superuser']
      q.is_staff = form.cleaned_data['staff']
      q.first_name = form.cleaned_data['firstname']
      q.last_name = form.cleaned_data['lastname']
      q.username = form.cleaned_data['username']
      q.set_password(form.cleaned_data['password'])
      q.email = form.cleaned_data['email']
      q.street = form.cleaned_data['street']
      q.city = form.cleaned_data['city']
      q.state = form.cleaned_data['state']
      q.zipcode = form.cleaned_data['zipcode']
      q.phone = form.cleaned_data['phone']
      q.save()
      return HttpResponseRedirect('/ManagerApp/users/')

  # return the template html
  template_vars = {
    'form': form,
  }
  return templater.render_to_response(request, 'edit_user.html', template_vars)

class UserForm(forms.Form):
  '''The question form'''
  #active = forms.NullBooleanField(required=False)
  superuser = forms.NullBooleanField(required=False)
  staff = forms.NullBooleanField(required=False)
  firstname = forms.CharField(required=False)
  lastname = forms.CharField(required=False)
  username = forms.CharField(required=False)
  password = forms.CharField(required=False)
  email = forms.CharField(required=False)
  street = forms.CharField(required=False)
  city = forms.CharField(required=False)
  state = forms.CharField(required=False)
  zipcode = forms.CharField(required=False)
  phone = forms.CharField(required=False)

我查了一堆教程，但仍然找不到正确限制超级用户访问的解决方案。

另外，在 edit_user 页面上，我让每个人都按他们的 ID 编制索引。因此 URL 将如下所示：ManagerApp/edit_user/1/（# 对应于客户 ID）

Answer 1

装饰器应用于单个函数。您的 user_passes_test 装饰器与 process_request__new 函数相关联，而不是与 process_request 函数相关联。