Repository: django-cms/django-cms

Issue:
Default content with CMS_PLACEHOLDER_CONF is not working for non super users
I have the following in my settings (version 3.0b4.dev12):

``` python
# CMS_PERMISSION = True

CMS_PLACEHOLDER_CONF = {
    'content': {
        'name' : 'Content',
        'plugins': ['TextPlugin'],
        'default_plugins':[
            {
                'plugin_type':'TextPlugin',
                'values':{
                    'body':'Lorem ipsum dolor sit amet, consectetur adipisicing elit. Culpa, repellendus, delectus, quo quasi ullam inventore quod quam aut voluptatum aliquam voluptatibus harum officiis officia nihil minus unde accusamus dolorem repudiandae.'
                },
            },
        ]
    }
}
```

When I create a new page as the superuser, the text plugin comes already inserted with the text above.

I've created a new user "editor" and given all available permissions just to rule this out. The difference is the superuser status. If not the superuser, then when this user creates a new page, the default content plugin above does not get inserted automatically.



Discussion:
You probably need to set the placeholder permission for the user

sorry forget that: if the placeholder is attached to a page he needs currently add-page permissions... that is probably wrong.... it should be change-permissions

no... that is correct as this happens on page creation... So the user needs page add permissions

My user has all permissions available attributed to him, just to rule this out.

If he didn't have page add permission, then it wouldn't be possible to add a page. The user can indeed create a new page, go to structure mode, and add a new text plugin.

It's just the default plugin that isn't added automatically when the page is created.

Does he have permissions on the specified plugin?

I can reproduce this

@yakky yes, all permissions.
![screenshot 2014-03-10 16 14 33](https://f.cloud.github.com/assets/174525/2376512/8d3c7d2c-a877-11e3-94bc-f4fb4d5bb4a3.png)
![screenshot 2014-03-10 16 14 09](https://f.cloud.github.com/assets/174525/2376513/8d3f2bda-a877-11e3-9d35-76e84ec445ac.png)


Resolving patch:
diff --git a/cms/models/placeholdermodel.py b/cms/models/placeholdermodel.py
--- a/cms/models/placeholdermodel.py
+++ b/cms/models/placeholdermodel.py
@@ -89,18 +89,26 @@ def _get_permission(self, request, key):
         """
         if request.user.is_superuser:
             return True
+        if self.page:
+            return self._get_object_permission(self.page, request, key)
+        for obj in self._get_attached_objects():
+            return self._get_object_permission(obj, request, key)
+
+    def _get_object_permission(self, obj, request, key):
         found = False
-        # check all attached models/objects for change permissions
-        for object in self._get_attached_objects():
-            model = object.__class__
-            opts = model._meta
-            perm_accessor = getattr(opts, 'get_%s_permission' % key)
-            perm_code = '%s.%s' % (opts.app_label, perm_accessor())
-            # if they don't have the permission for this attached model or object, bail out
-            if not (request.user.has_perm(perm_code) or request.user.has_perm(perm_code, object)):
-                return False
-            else:
-                found = True
+        model = obj.__class__
+        opts = model._meta
+        perm_accessor = getattr(opts, 'get_%s_permission' % key)
+        perm_code = '%s.%s' % (opts.app_label, perm_accessor())
+        # if they don't have the permission for this attached model or object, bail out
+        if not (request.user.has_perm(perm_code) or request.user.has_perm(perm_code, obj)):
+            return False
+        else:
+            found = True
+        if not (request.user.has_perm(perm_code) or request.user.has_perm(perm_code, obj)):
+            return False
+        else:
+            found = True
         return found
 
     def has_change_permission(self, request):


Test patch:
diff --git a/cms/test_utils/cli.py b/cms/test_utils/cli.py
--- a/cms/test_utils/cli.py
+++ b/cms/test_utils/cli.py
@@ -208,7 +208,6 @@ def configure(db_url, **extra):
                 'TextPlugin', 'SnippetPlugin'),
                 'name': gettext("sidebar column")
             },
-
             'col_left': {
                 'plugins': ('FilePlugin', 'FlashPlugin', 'LinkPlugin', 'PicturePlugin',
                 'TextPlugin', 'SnippetPlugin', 'GoogleMapPlugin', 'MultiColumnPlugin', 'StylePlugin'),
@@ -218,9 +217,8 @@ def configure(db_url, **extra):
                 },
                 'plugin_labels': {
                     'LinkPlugin': gettext('Add a link')
-                }
+                },
             },
-
             'col_right': {
                 'plugins': ('FilePlugin', 'FlashPlugin', 'LinkPlugin', 'PicturePlugin',
                 'TextPlugin', 'SnippetPlugin', 'GoogleMapPlugin', 'MultiColumnPlugin', 'StylePlugin'),
diff --git a/cms/tests/permmod.py b/cms/tests/permmod.py
--- a/cms/tests/permmod.py
+++ b/cms/tests/permmod.py
@@ -124,7 +124,7 @@ def setUp(self):
 
             # slave page & slave user
 
-            self.slave_page = create_page("slave-home", "nav_playground.html", "en",
+            self.slave_page = create_page("slave-home", "col_two.html", "en",
                                           parent=self.master_page, created_by=self.user_super)
 
             assign_user_to_page(self.slave_page, self.user_slave, grant_all=True)
@@ -209,11 +209,29 @@ def test_slave_can_add_page_under_slave_home(self):
 
             # publish as slave, published as user_master before 
             publish_page(page, self.user_slave, 'en')
-
             # user_slave is moderator for this page
             # approve / publish as user_slave
             # user master should be able to approve as well
 
+    def test_default_plugins(self):
+            with SettingsOverride(CMS_PLACEHOLDER_CONF={
+                'col_left': {
+                    'default_plugins': [
+                        {
+                            'plugin_type': 'TextPlugin',
+                            'values': {
+                                'body': 'Lorem ipsum dolor sit amet, consectetur adipisicing elit. Culpa, repellendus, delectus, quo quasi ullam inventore quod quam aut voluptatum aliquam voluptatibus harum officiis officia nihil minus unde accusamus dolorem repudiandae.'
+                            },
+                        },
+                    ]
+                },
+            }):
+                with self.login_user_context(self.user_slave):
+                    self.assertEqual(CMSPlugin.objects.count(), 0)
+                    response = self.client.get(self.slave_page.get_absolute_url(), {'edit': 1})
+                    self.assertEqual(response.status_code, 200)
+                    self.assertEqual(CMSPlugin.objects.count(), 1)
+
     def test_page_added_by_slave_can_be_published_by_user_master(self):
         # add page
         page = create_page("page", "nav_playground.html", "en",