Flask-Admin&身份验证:“/ admin”受保护,但“/ admin / anything-else”不受保护

时间:2013-07-11 00:40:59

标签: python flask flask-login flask-security flask-admin

我尝试使用Flask和Flask-SuperAdmin自定义管理员视图,但是,索引视图和子视图显然没有使用相同的is_accessible方法:

编辑:我设法弄清楚我做错了什么。我需要在每个视图类中定义is_accessible。这是使用mixin-class完成的,如固定代码中所示:

app / frontend / admin.py( FIXED& WORKING CODE

from flask.ext.security import current_user, login_required
from flask.ext.superadmin import expose, AdminIndexView
from flask.ext.superadmin.model.base import ModelAdmin
from ..core import db

# all admin views should subclass AuthMixin
class AuthMixin(object):
    def is_accessible(self):
        if current_user.is_authenticated() and current_user.has_role('Admin'):
            return True
        return False

# the view that gets used for the admin home page
class AdminIndex(AuthMixin, AdminIndexView):
    # use a custom template for the admin home page
    @expose('/')
    def index(self):
        return self.render('admin/index.jade')

# base view for all other admin pages
class AdminBase(AuthMixin, ModelAdmin): # AuthMixin must come before ModelAdmin!
    """A base class for customizing admin views using our DB connection."""
    session = db.session

# customize the form displays for User and Role models

class UserAdmin(AdminBase):
    list_display = ('email',)
    search_fields = ('email',)
    exclude = ['password',]
    #fields_order = ['email', 'active', 'last_login_at',]

class RoleAdmin(AdminBase):
    field_args = {'name': {'label': 'Role Name'},
                'description': {'description': "Duties & Responsibilities"}}
    list_display = ('name', 'description')

然后使用我们的管理员视图设置Flask应用:
应用/ factory.py

app = Flask(package_name, instance_relative_config=True)
# other app setup stuff like db, mail, ...

from .frontend.admin import AdminIndex, UserAdmin, RoleAdmin
admin = Admin(app, name='PyCBM Admin',
              index_view=AdminIndex(url='/admin', name='Admin Home'))
admin.register(User, UserAdmin)
admin.register(Role, RoleAdmin)

所以,就像标题所说,这就是问题所在:

/admin throws a 403 when an 'Admin' user isn't logged in, like it should, but
/admin/user lets anybody right on in.

我挖掘了源代码,试图找到另一个"全局管理蓝图"安全功能 - 也许我是盲人 - 但我找不到。

1 个答案:

答案 0 :(得分:1)

如果您转到flask_superadmin/base.py,请在第193行找到以下代码段:

def _handle_view(self, name, *args, **kwargs):
    if not self.is_accessible():
        return abort(403)

所以也许这个方法必须由AdminIndex覆盖,以避免返回abort(403)但重定向到/login