Skip to content

feat: Setting to block deletion of public versions #501

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fsbraun wants to merge 8 commits into
base: master
Choose a base branch
from
Open

feat: Setting to block deletion of public versions #501

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
b8b48e5
feat: Add setting to only protect published objects from deletion
fsbraun Nov 17, 2025
b086d4c
fix: Only show actual public objects as reason for failed deletion
fsbraun Nov 17, 2025
f1fd556
chore: Add __str__ test
fsbraun Nov 17, 2025
1a77ee5
chore: Update readme
fsbraun Nov 17, 2025
a5a03c3
Update tests/test_models.py
fsbraun Feb 3, 2026
5c5c907
Update docs/api/settings.rst
fsbraun Feb 3, 2026
7c3416a
Apply suggestion from @fsbraun
fsbraun Feb 3, 2026
e552e8e
Merge branch 'master' into feat/protect-published
fsbraun Feb 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion README.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
|PyPiVersion| |DjVersion| |CmsVersion|
|PyPiVersion| |PyVersion| |DjVersion| |CmsVersion| |Coverage|

*********************
django CMS Versioning
Expand Down Expand Up @@ -117,3 +117,6 @@ do not forget to run the ``compilemessages`` management command.
.. |CmsVersion| image:: https://img.shields.io/pypi/frameworkversions/django-cms/djangocms-versioning.svg?style=flat-square
:target: https://pypi.python.org/pypi/djangocms-versioning
:alt: django CMS versions

.. |Coverage| image:: https://codecov.io/gh/django-cms/djangocms-versioning/graph/badge.svg?token=Jyx7Ilpibf
:target: https://codecov.io/gh/django-cms/djangocms-versioning
4 changes: 4 additions & 0 deletions djangocms_versioning/constants.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,3 +26,7 @@
"archived": _("Archived"),
"empty": _("Empty"),
}

DELETE_NON_PUBLIC_ONLY = "non-public only"
DELETE_ANY = "any"
DELETE_NONE = "none"
26 changes: 24 additions & 2 deletions djangocms_versioning/models.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,23 @@
permission_error_message = _("You do not have permission to perform this action")


def PROTECT_IF_PUBLIC_VERSION(collector, field, sub_objs, using):
public_exists = sub_objs.filter(state=constants.PUBLISHED).exists()
if public_exists:
# Any public objects?
raise models.ProtectedError(
f"Cannot delete some instances of model '{field.remote_field.model.__name__}' because they are "
f"referenced through a protected foreign key: '{sub_objs[0].__class__.__name__}.{field.name}'",
public_exists,
)
models.SET_NULL(collector, field, sub_objs, using)


def allow_deleting_versions(collector, field, sub_objs, using):
if ALLOW_DELETING_VERSIONS:
if ALLOW_DELETING_VERSIONS == constants.DELETE_NON_PUBLIC_ONLY:
PROTECT_IF_PUBLIC_VERSION(collector, field, sub_objs, using)
elif ALLOW_DELETING_VERSIONS == constants.DELETE_ANY or ALLOW_DELETING_VERSIONS is True:
# Backwards compatibility: True means DELETE_ANY
models.SET_NULL(collector, field, sub_objs, using)
else:
models.PROTECT(collector, field, sub_objs, using)
Expand Down Expand Up @@ -132,7 +147,14 @@ class Meta:
)

def __str__(self):
return f"Version #{self.pk}"
state = dict(constants.VERSION_STATES).get(self.state, self.state)
if self.object_id:
try:
return f"Version #{self.pk} ({state}) of {self.content}"
except Exception:
# In case the content object cannot be stringified
pass
return f"Version #{self.pk} ({state})"

def verbose_name(self):
return _("Version #{number} ({state} {date})").format(
Expand Down
18 changes: 12 additions & 6 deletions docs/api/settings.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,7 @@ All Django CMS Versioning settings are optional and have sensible defaults. Add

.. py:attribute:: DJANGOCMS_VERSIONING_ALLOW_DELETING_VERSIONS

**Default**: ``False``

**Type**: boolean

Controls whether users can delete version objects.
Defaults to ``False`` (``constants.DELETE_NONE``)

When ``False`` (default):
- Version objects that are the source of another version are protected from deletion
Expand All @@ -22,7 +18,17 @@ All Django CMS Versioning settings are optional and have sensible defaults. Add
- Set this only if you don't need a full version history
- Use with caution as it can break the version chain

**Example**::
If set to ``constants.DELETE_ANY`` (``"any"``) users can delete version objects
if the have the appropriate rights. Set this to ``"any"`` if you want users to be
able to delete versioned objects and you do not need a full history of versions,
e.g. for documentation purposes.

If set to ``constants.DELETE_NON_PUBLIC_ONLY`` (``"non-public only"``) users can
delete version objects which are not published and which are not a source for
another version object. This allows users to delete draft, unpublished, or archived
versions, but protects published versions from deletion. This is particularly
useful if you want to allow users to clean up their version history, but still want to
ensure that published content remains documented and is not deleted accidentally.

# settings.py
DJANGOCMS_VERSIONING_ALLOW_DELETING_VERSIONS = True
Expand Down
19 changes: 19 additions & 0 deletions tests/test_models.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,6 +238,25 @@ def test_grouper(self):
version = factories.PollVersionFactory()
self.assertEqual(version.grouper, version.content.poll)

def test_version_str(self):
version = factories.PollVersionFactory()
expected_str = f"Version #{version.pk} (Draft) of {version.content}"
self.assertEqual(str(version), expected_str)

def test_version_str_failing(self):
def failing_str_method(self):
raise Exception("Cannot stringify")

version = factories.PollVersionFactory()
original_str_method = version.content.__class__.__str__
try:
version.content.__class__.__str__ = failing_str_method

expected_str = f"Version #{version.pk} (Draft)"
self.assertEqual(str(version), expected_str)
finally:
version.content.__class__.__str__ = original_str_method


class TestVersionQuerySet(CMSTestCase):
def test_version_uses_versionqueryset_as_manager(self):
Expand Down
53 changes: 51 additions & 2 deletions tests/test_settings.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@


class DeletionTestCase(CMSTestCase):
@override_settings(DJANGOCMS_VERSIONING_ALLOW_DELETING_VERSIONS=False)
@override_settings(DJANGOCMS_VERSIONING_ALLOW_DELETING_VERSIONS=constants.DELETE_NONE)
def test_deletion_not_possible(self):
# Since djangocms_versionings.models stores the setting, we need to update that copy
versioning_models.ALLOW_DELETING_VERSIONS = settings.DJANGOCMS_VERSIONING_ALLOW_DELETING_VERSIONS
Expand All @@ -32,7 +32,7 @@ def test_deletion_not_possible(self):
self.assertRaises(models.deletion.ProtectedError,
versioning_models.Version.objects.get(pk=pk1).content.delete)

@override_settings(DJANGOCMS_VERSIONING_ALLOW_DELETING_VERSIONS=True)
@override_settings(DJANGOCMS_VERSIONING_ALLOW_DELETING_VERSIONS=constants.DELETE_ANY)
def test_deletion_possible(self):
# Since djangocms_versionings.models stores the setting, we need to update that copy
versioning_models.ALLOW_DELETING_VERSIONS = settings.DJANGOCMS_VERSIONING_ALLOW_DELETING_VERSIONS
Expand All @@ -55,3 +55,52 @@ def test_deletion_possible(self):
# try deleting and see if error is raised
Copy link
Contributor

@sourcery-ai sourcery-ai bot Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue (testing): This test deletes a published version while the setting name and PR description suggest only non-public deletions should be allowed.

In test_deletion_non_public_possible, version1 is set to PUBLISHED before calling version1.content.delete(). This makes the test assert that deleting a public version is allowed under DELETE_NON_PUBLIC_ONLY, which conflicts with both the setting name and the PR description (“allow non-public deletions and protect public versions”). Please confirm the intent: if we want to verify that only non‑public versions can be deleted, the test should instead delete a non‑public object (e.g. version2.content, which remains a draft) or otherwise make clear that the deleted object is not public.

versioning_models.Version.objects.get(pk=pk1).content.delete()
self.assertIsNone(versioning_models.Version.objects.get(pk=version2.pk).source)

@override_settings(DJANGOCMS_VERSIONING_ALLOW_DELETING_VERSIONS=constants.DELETE_NON_PUBLIC_ONLY)
def test_deletion_non_public_possible(self):
# Since djangocms_versionings.models stores the setting, we need to update that copy
versioning_models.ALLOW_DELETING_VERSIONS = settings.DJANGOCMS_VERSIONING_ALLOW_DELETING_VERSIONS
poll = factories.PollFactory()
version1 = factories.PollVersionFactory(
content__poll=poll,
content__language="en",
)
pk1 = version1.pk
# Now publish and then edit redirect to create a draft on top of published version
version1.publish(user=self.get_superuser())
self.assertEqual(versioning_models.Version.objects.get(pk=pk1).state, constants.PUBLISHED)

version2 = version1.copy(created_by=self.get_superuser())
version2.save()

# Check of source field is set
self.assertIsNotNone(version2.source)

# try deleting and see if error is raised
versioning_models.Version.objects.get(pk=pk1).content.delete()
self.assertIsNone(versioning_models.Version.objects.get(pk=version2.pk).source)

@override_settings(DJANGOCMS_VERSIONING_ALLOW_DELETING_VERSIONS=constants.DELETE_NON_PUBLIC_ONLY)
def test_deletion_public_not_possible(self):
# Since djangocms_versionings.models stores the setting, we need to update that copy
versioning_models.ALLOW_DELETING_VERSIONS = settings.DJANGOCMS_VERSIONING_ALLOW_DELETING_VERSIONS
poll = factories.PollFactory()
version1 = factories.PollVersionFactory(
content__poll=poll,
content__language="en",
)
pk1 = version1.pk
# Now publish and then edit redirect to create a draft on top of published version
version1.publish(user=self.get_superuser())
self.assertEqual(versioning_models.Version.objects.get(pk=pk1).state, constants.PUBLISHED)

version2 = version1.copy(created_by=self.get_superuser())
version2.save()
version2.publish(user=self.get_superuser())

# Check of source field is set
self.assertIsNotNone(version2.source)

# try deleting and see if error is raised
self.assertRaises(models.deletion.ProtectedError,
versioning_models.Version.objects.get(pk=pk1).content.delete)
Loading