Fixed #33269 -- Made AnonymousUser/PermissionsMixin.has_perms() raise ValueError on string or non-iterable perm_list.

1 files changed, 5 insertions, 0 deletions

diff --git a/django/contrib/auth/models.py b/django/contrib/auth/models.py
index 5f092f0ae8..a9faef3517 100644
--- a/django/contrib/auth/models.py
+++ b/django/contrib/auth/models.py
@@ -8,6 +8,7 @@ from django.core.mail import send_mail
 from django.db import models
 from django.db.models.manager import EmptyManager
 from django.utils import timezone
+from django.utils.itercompat import is_iterable
 from django.utils.translation import gettext_lazy as _
 
 from .validators import UnicodeUsernameValidator
@@ -304,6 +305,8 @@ class PermissionsMixin(models.Model):
         Return True if the user has each of the specified permissions. If
         object is passed, check if the user has all required perms for it.
         """
+        if not is_iterable(perm_list) or isinstance(perm_list, str):
+            raise ValueError('perm_list must be an iterable of permissions.')
         return all(self.has_perm(perm, obj) for perm in perm_list)
 
     def has_module_perms(self, app_label):
@@ -452,6 +455,8 @@ class AnonymousUser:
         return _user_has_perm(self, perm, obj=obj)
 
     def has_perms(self, perm_list, obj=None):
+        if not is_iterable(perm_list) or isinstance(perm_list, str):
+            raise ValueError('perm_list must be an iterable of permissions.')
         return all(self.has_perm(perm, obj) for perm in perm_list)
 
     def has_module_perms(self, module):