[BUG] Page permissions dialog fails for non-superusers with AttributeError in django CMS 3.11.11
In django CMS 3.11.11, opening Page → Permissions → All permissions as a non-superuser leaves the dialog displaying “Loading”. The GET request to /admin/cms/page/<page_id>/permissions/ returns HTTP 500.
Environment
django CMS 3.11.11 Django 3.2.20 Python 3.10.12 Page permissions enabled
Steps to reproduce
Sign in as a staff user who is not a superuser and has page permissions. Open a page in the CMS. Open Page → Permissions → All permissions.
Actual result
The dialog remains on “Loading”. The server raises:
AttributeError: 'tuple' object has no attribute 'contains'
The exception occurs in cms/admin/pageadmin.py, in PageAdmin.get_permissions():
can_change = any(
perm_tuple.contains(page_path)
for perm_tuple in allowed_pages
)Expected result
The permissions dialog loads and displays the page permission entries.
Tested fix
Import PermissionTuple from cms.models.permissionmodels and convert each returned tuple before calling contains():
can_change = any(
PermissionTuple(perm_tuple).contains(page_path)
for perm_tuple in allowed_pages
)After applying this change and reloading the application, the dialog loads successfully for the affected user.
Fix available in the current source code
The current main branch already imports PermissionTuple and converts each permission tuple before calling contains(). However, the published django CMS 3.11.11 package still calls perm_tuple.contains(page_path) directly, causing the exception described above.
Could this fix be backported to the 3.11 branch and included in a new 3.11 patch release? This would allow projects still using django CMS 3.11 to remove their local patch.
Source: django-cms/django-cms