他们可以在任何帐户（包括他们自己的）上设置is_superuser标志。 （!!!）

不仅如此，他们也获得了一个一个赋予自己任何权限的能力，同样的效果...

我确定它涉及到子类化django.contrib.auth.forms.UserChangeForm

嗯，不一定。您在django管理员的更改页面中看到的表单由管理应用程序动态创建，并且基于 UserChangeForm ，但此类几乎不将正则表达式验证添加到用户名字段。

并将其挂接到我已经定制的UserAdmin对象...

自定义 UserAdmin 是去这里的方式。基本上，您要将 fieldsets 属性更改为：

  class MyUserAdmin（UserAdmin）：
 fieldsets =（
（无，{'fields'：（'username'，'password'）}），
（_（'个人信息' ，{'fields'：（'first_name'，'last_name'，'email'）}），
＃删除权限部分
＃（_（'Permissions'），{'fields' 'is_staff'，'is_active'，'is_superuser'，'user_permissions'）}），
（_（'Important dates'），{'fields'：（'last_login'，'date_joined'）}），
＃保持组件部分？好的，但是他们不应该能够定义
＃自己的组，直到你... 
（_（'Groups'），{'fields '：（'groups'，）}），
）
 

但这里的问题是该限制将适用于所有用户。如果这不是你想要的，你可以根据用户的权限覆盖 change_view 的行为不同。代码片段：

  class MyUserAdmin（UserAdmin）：
 staff_fieldsets =（
（None，{'fields '：（'username'，'password'）}），
（_（'个人信息'），{'fields'：（'first_name'，'last_name'，'email'）}），
 $没有权限
（_（'重要日期'），{'fields'：（'last_login'，'date_joined'）}），
（_（'Groups'），{' '：（'groups'，）}），
）

 def change_view（self，request，* args，** kwargs）：
＃for non-superuser 
 if not request.user.is_superuser：
 try：
 self.fieldsets = self.staff_fieldsets 
 response = super（MyUserAdmin，self）.change_view（request，* args，** kwargs ）
 finally：
＃将fieldsets重置为其原始值
 self.fieldsets = UserAdmin.fieldsets 
返回响应
 else：
 return super（MyUserAdmin，self）.change_view（request，* args，** kwargs）
 

I have a django site with a large customer base. I would like to give our customer service department the ability to alter normal user accounts, doing things like changing passwords, email addresses, etc. However, if I grant someone the built-in auth | user | Can change user permission, they gain the ability to set the is_superuser flag on any account, including their own. (!!!)

What's the best way to remove this option for non-superuser staff? I'm sure it involves subclassing django.contrib.auth.forms.UserChangeForm and hooking it into my already-custom UserAdmin object... somehow. But I can't find any documentation on how to do this, and I don't yet understand the internals well enough.

they gain the ability to set the is_superuser flag on any account, including their own. (!!!)

Not only this, they also gain the ability to give themselves any permissions one-by-one, same effect...

I'm sure it involves subclassing django.contrib.auth.forms.UserChangeForm

Well, not necessarily. The form you see in the change page of django's admin is dynamically created by the admin application, and based on UserChangeForm, but this class barely adds regex validation to the username field.

and hooking it into my already-custom UserAdmin object...

A custom UserAdmin is the way to go here. Basically, you want to change the fieldsets property to something like that :

class MyUserAdmin(UserAdmin):
    fieldsets = (
        (None, {'fields': ('username', 'password')}),
        (_('Personal info'), {'fields': ('first_name', 'last_name', 'email')}),
        # Removing the permission part
        # (_('Permissions'), {'fields': ('is_staff', 'is_active', 'is_superuser', 'user_permissions')}),
        (_('Important dates'), {'fields': ('last_login', 'date_joined')}),
        # Keeping the group parts? Ok, but they shouldn't be able to define
        # their own groups, up to you...
        (_('Groups'), {'fields': ('groups',)}),
    )

But the problem here is that this restriction will apply to all users. If this is not what you want, you could for example override change_view to behave differently depending on the permission of the users. Code snippet :

class MyUserAdmin(UserAdmin):
    staff_fieldsets = (
        (None, {'fields': ('username', 'password')}),
        (_('Personal info'), {'fields': ('first_name', 'last_name', 'email')}),
        # No permissions
        (_('Important dates'), {'fields': ('last_login', 'date_joined')}),
        (_('Groups'), {'fields': ('groups',)}),
    )

    def change_view(self, request, *args, **kwargs):
        # for non-superuser
        if not request.user.is_superuser:
            try:
                self.fieldsets = self.staff_fieldsets
                response = super(MyUserAdmin, self).change_view(request, *args, **kwargs)
            finally:
                # Reset fieldsets to its original value
                self.fieldsets = UserAdmin.fieldsets
            return response
        else:
            return super(MyUserAdmin, self).change_view(request, *args, **kwargs)