#8875·django-cms

[BUG] Page permissions dialog fails for non-superusers with AttributeError in django CMS 3.11.11

Author: wagnerfelixCreated Sep 17, 2026Updated Sep 18, 2026

In django CMS 3.11.11, opening PagePermissionsAll permissions as a non-superuser leaves the dialog displaying “Loading”. The GET request to /admin/cms/page/<page_id>/permissions/ returns HTTP 500.

Environment

django CMS 3.11.11 Django 3.2.20 Python 3.10.12 Page permissions enabled

Steps to reproduce

Sign in as a staff user who is not a superuser and has page permissions. Open a page in the CMS. Open Page → Permissions → All permissions.

Actual result

The dialog remains on “Loading”. The server raises:

AttributeError: 'tuple' object has no attribute 'contains'

The exception occurs in cms/admin/pageadmin.py, in PageAdmin.get_permissions():

can_change = any(
    perm_tuple.contains(page_path)
    for perm_tuple in allowed_pages
)

Expected result

The permissions dialog loads and displays the page permission entries.

Tested fix

Import PermissionTuple from cms.models.permissionmodels and convert each returned tuple before calling contains():

can_change = any(
    PermissionTuple(perm_tuple).contains(page_path)
    for perm_tuple in allowed_pages
)

After applying this change and reloading the application, the dialog loads successfully for the affected user.

Fix available in the current source code

The current main branch already imports PermissionTuple and converts each permission tuple before calling contains(). However, the published django CMS 3.11.11 package still calls perm_tuple.contains(page_path) directly, causing the exception described above.

Could this fix be backported to the 3.11 branch and included in a new 3.11 patch release? This would allow projects still using django CMS 3.11 to remove their local patch.