_checkperm calls has_perm prematurely

[DylanYoung]

_check_perm calls has_perm first. This is a but of an annoyance in our use-case as we log missing permissions in our has_perm implementation. It also seems unnecessary since we know what a valid permission looks like.

    def _checkperm(user, perm):
        return (user.has_perm(perm)
                or (perm == 'is_authenticated' and user.is_authenticated())
                # Handles, say, is_staff; insist on True so that we
                # don't inadvertently match a function.
                or (True == getattr(user, perm, None)))

Minimal A/C:

• If a permission contains a dot/period then check has_perm
• else do the attribute check

An alternative that might be marginally more efficient and definitely more safe would be a whitelist of attributes that can be used by the PermissionRequired Middleware.

[DylanYoung]

@wolfe Thoughts on the proposed implementations? I'm partial to the whitelist...

[wolfe]

No opinion here... it's been too long.