mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-04-05 05:56:42 +00:00
Code Issues 32 Releases Wiki Activity

[1.8.x] Refs #23559 -- warned about consequences of letting users edit User model in admin.

Browse Source 
Backport of f6b09a7f85c3b67b2011553838b079788c413432 from master
This commit is contained in:
Remco Kranenburg 2015-03-13 08:48:39 -04:00 committed by Tim Graham
parent 06085024f6
commit 6f555e54f7
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
docs/topics/auth/default.txt
View File

@ -1427,6 +1427,11 @@ have the power to create superusers, which can then, in turn, change other
users. So Django requires add *and* change permissions as a slight security
measure.
Be thoughtful about how you allow users to manage permissions. If you give a
non-superuser the ability to edit users, this is ultimately the same as giving
them superuser status because they will be able to elevate permissions of
users including themselves!
Changing Passwords
------------------