Merge pull request #93 from Skeptiker88/master

added permission check for all child types

polymorphic/admin.py

@@ -65,7 +65,7 @@ class PolymorphicChildModelFilter(admin.SimpleListFilter):
     parameter_name = 'polymorphic_ctype'
 
     def lookups(self, request, model_admin):
-        return model_admin.get_child_type_choices()
+        return model_admin.get_child_type_choices(request, 'change')
 
     def queryset(self, request, queryset):
         try:
@@ -176,12 +176,21 @@ class PolymorphicParentModelAdmin(admin.ModelAdmin):
         return self.child_models
 
 
-    def get_child_type_choices(self):
+    def get_child_type_choices(self, request, action):
         """
-        Return a list of polymorphic types which can be added.
+        Return a list of polymorphic types for which the user has the permission to perform the given action.
         """
+        try:
+            from django.contrib.auth import get_permission_codename
+        except ImportError:
+            # Django < 1.6
+            from django.contrib.auth.management import _get_permission_codename as get_permission_codename
+
         choices = []
         for model, _ in self.get_child_models():
+            if not request.user.has_perm('%s.%s' % (model._meta.app_label,
+                                                    get_permission_codename(action, model._meta))):
+                continue
             ct = ContentType.objects.get_for_model(model, for_concrete_model=False)
             choices.append((ct.id, model._meta.verbose_name))
         return choices
@@ -325,7 +334,7 @@ class PolymorphicParentModelAdmin(admin.ModelAdmin):
         if request.META['QUERY_STRING']:
             extra_qs = '&' + request.META['QUERY_STRING']
 
-        choices = self.get_child_type_choices()
+        choices = self.get_child_type_choices(request, 'add')
         if len(choices) == 1:
             return HttpResponseRedirect('?ct_id={0}{1}'.format(choices[0][0], extra_qs))