Verify use of check_global_permission
The direct check on ModelBackend().has_perm
looks questionnable. Just using the has_perm
method on the User
object checks all backends, so we should find a way to use that in predicates without causing an endless loop instead (probably by having ModelBackend
be iterated before ObjectPermissionBackend
, which it probably already is).
This has to be done in all apps.