From df90e462d91d3a77aa89b69d791bf17c2bf7ff9b Mon Sep 17 00:00:00 2001 From: Nick Pope Date: Mon, 12 Mar 2018 15:48:46 +0000 Subject: Fixed #29212 -- Doc'd redirect loop if @permission_required used with redirect_authenticated_user. --- docs/topics/auth/default.txt | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'docs') diff --git a/docs/topics/auth/default.txt b/docs/topics/auth/default.txt index 3d9317f8f6..9f864c64d7 100644 --- a/docs/topics/auth/default.txt +++ b/docs/topics/auth/default.txt @@ -712,6 +712,10 @@ The ``permission_required`` decorator def my_view(request): ... + This also avoids a redirect loop when :class:`.LoginView`'s + ``redirect_authenticated_user=True`` and the logged-in user doesn't have + all of the required permissions. + .. currentmodule:: django.contrib.auth.mixins The ``PermissionRequiredMixin`` mixin @@ -981,6 +985,10 @@ implementation details see :ref:`using-the-views`. `_" information leakage, host all images and your favicon on a separate domain. + Enabling ``redirect_authenticated_user`` can also result in a redirect + loop when using the :func:`.permission_required` decorator + unless the ``raise_exception`` parameter is used. + * ``success_url_allowed_hosts``: A :class:`set` of hosts, in addition to :meth:`request.get_host() `, that are safe for redirecting after login. Defaults to an empty :class:`set`. -- cgit v1.3