ixgadmin/ixg_platform
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ixg_platform/apps/core
History
Exact
ixgadmin ef6f217e45 Gate the administration area by role, not by is_staff 
RBACMiddleware only guarded non-staff users, so any staff account stepped
past the role routing for /admin/ — an ops or buyer account with the flag
set could reach the admin index, which embeds the model registry, and a
later permission grant would have been inherited. Restrict /admin/ to the
admin role (superuser excepted) and hide the ops Admin link from non-admins.

Also close the second finding: the seed set is_staff only on creation, so
a buyer whose flag had drifted stayed staff on every re-run. Derive it from
the role on the update path too, and align existing rows with a one-off
migration so the flag never disagrees with the role.
2026-09-25 16:47:50 +00:00
..
management Gate the administration area by role, not by is_staff 2026-09-25 16:47:50 +00:00
static/vendor/leaflet Origin zones: draw the stored polygon on a map in the admin (Leaflet 1.9.4) 2026-09-16 16:39:07 +00:00
__init__.py Initial commit: IXG Platform 2026-07-29 16:48:48 +00:00
apps.py Initial commit: IXG Platform 2026-07-29 16:48:48 +00:00
middleware.py Gate the administration area by role, not by is_staff 2026-09-25 16:47:50 +00:00
tests.py Gate the administration area by role, not by is_staff 2026-09-25 16:47:50 +00:00
tiles.py Serve map tiles from our own origin 2026-09-17 13:00:59 +00:00
views.py Add public buyer self-registration 2026-09-21 11:30:29 +00:00