How to limit a view to superuser only?

Question

view.py

@login_required @permission_required('is_superuser') def score_reset(request):    pass 

url.py

url(r'^score-reset/$', score_reset, name='score-reset'),     

I have the following code and to my surprise I still hit the function, despite being logged in with a non superuser. I was expecting to get a permission denied.

What am I missing?

Answer 1

is_superuser isn't a permission, it's an attribute on the user model. Django already has another decorator you can make use of called user_passes_test to perform this check:

from django.contrib.auth.decorators import user_passes_test  @user_passes_test(lambda u: u.is_superuser) def score_reset(self,...):     ... 

• allowing only super user login
• Django is_staff permission decorator