python - Hide Flask-Admin route -


i'm building flask blog , setting admin interface now. i've read setting security flask-admin. i've managed set security (access restricted logged-in users) models, users can still access '/admin' route has bare home button in it.

my question is: there way hide or protect '/admin' route, unauthenticated user redirected login page/ denied access?

thanks lot!

attaching current admin setup:

from flask_admin import admin flask_login import current_user flask_admin.contrib import sqla wtforms.widgets import textarea wtforms import textareafield samo.models import user, post, tag samo import app,db  admin = admin(app, name='admin', template_mode='bootstrap3')  class cktextareawidget(textarea):     def __call__(self, field, **kwargs):         if kwargs.get('class'):             kwargs['class'] += ' ckeditor'         else:             kwargs.setdefault('class', 'ckeditor')         return super(cktextareawidget, self).__call__(field, **kwargs)        class cktextareafield(textareafield):     widget = cktextareawidget()  class postadmin(sqla.modelview):     form_overrides = dict(content=cktextareafield)     create_template = 'blog/ckeditor.html'     edit_template = 'blog/ckeditor.html'     form_excluded_columns = ('slug')         def is_accessible(self):         return current_user.is_authenticated admin.add_view(postadmin(post, db.session))  class tagadmin(sqla.modelview):     def is_accessible(self):         return current_user.is_authenticated admin.add_view(tagadmin(tag, db.session))  class useradmin(sqla.modelview):     def is_accessible(self):         return current_user.is_authenticated admin.add_view(useradmin(user, db.session)) 

i use such configuration described websites. use adminindexview. here example of how handle login, logout , redirection in case user not authorized.

class flaskyadminindexview(adminindexview):      @expose('/')     def index(self):         if not login.current_user.is_authenticated:             return redirect(url_for('.login'))         return super(flaskyadminindexview, self).index()      @expose('/login', methods=['get', 'post'])     def login(self):         form = loginform(request.form)         if helpers.validate_form_on_submit(form):             user = form.get_user()             if user not none , user.verify_password(form.password.data):                 login.login_user(user)             else:                 flash('invalid username or password.')         if login.current_user.is_authenticated:             return redirect(url_for('.index'))         self._template_args['form'] = form         return super(flaskyadminindexview, self).index()      @expose('/logout')     @login_required     def logout(self):         login.logout_user()         return redirect(url_for('.login')) 

in __init__.py create admin object this:

admin = admin(index_view=flaskyadminindexview())


Comments

Popular posts from this blog

aws api gateway - SerializationException in posting new Records via Dynamodb Proxy Service in API -

asp.net - Problems sending emails from forum -