fusionbox/django-widgy — pull request #76 by rockymeza (2013-06-25 22:39:03+00:00)
Title: UnsafeHtml Widget

I added an UnsafeHtml Widget for including things that would be bleached by the normal HtmlWidget. It is called UnsafeHtml Widget because of the possibility of a permissions escalation attack from a rogue staff member. As such, no non-superuser should have any permissions related to it.

In order to protect against staff members without permissions, I added the AuthorizedWidgySite class which provides an interface for views to authorize user actions. I mimicked the ModelAdmin interface in that WidgySites now have three permission methods:

- `has_add_permission(self, user, content_class)`
- `has_change_permission(self, user, content_object)`
- `has_delete_permission(self, user, content_object)`

Several of the API views now explicitly check those permissions using the site.