How to serve files only to a is_staff user?

I would like to know how to serve files only to staff users (that is onl开发者_JAVA技巧y when is_staff=True).

if you are using apache 2.2 then consider a location like example

<Location /example/>
        AuthType Basic
        AuthName "example.com"
        AuthUserFile /dev/null
        AuthBasicAuthoritative Off
        Require valid-user

        SetEnv DJANGO_SETTINGS_MODULE mysite.settings
        PythonAuthenHandler django.contrib.auth.handlers.modpython
    </Location>

By default, the authentication handler will limit access to the /example/ location to users marked as staff members. You can use a set of PythonOption directives to modify this behavior:

DjangoRequireStaffStatus :If set to on only "staff" users (i.e. those with the is_staff flag set) will be allowed.

DjangoRequireSuperuserStatus: If set to on only superusers (i.e. those with the is_superuser flag set) will be allowed. Defaults to off.

DjangoPermissionName :The name of a permission to require for access. By default no specific permission will be required.

If you mean dynamic content generated by Django, read on. Else, for static files, go with the http server config solution described in the other answer.

You can set a fine-grained control at the view level using a decorator:

@user_passes_test(lambda u: u.is_staff)
def my_view(request):
    ...

More info at http://docs.djangoproject.com/en/dev/topics/auth/#django.contrib.auth.decorators.user_passes_test

If you want to make a generalised use of this you may do:

staff_only = user_passes_test(lambda u: u.is_staff)

...and include this in your url configuration:

urlpatterns = patterns('',
    url(r'^url1/$', 
        staff_only(views.my_view1),
        name = 'myapp_myview1'),
    url(r'^url2/$', 
        staff_only(views.my_view2),
        name = 'myapp_myview2'),

...etc.