rezometz/re2o
8
0
Fork 0
mirror of https://gitlab.federez.net/re2o/re2o synced 2024-05-19 09:02:35 +00:00
Code Issues Releases Wiki Activity

lets be sure that api permissions wont trigger on functional views

Browse source
This commit is contained in:
chapeau 2020-11-29 18:19:46 +01:00 committed by Gabriel Detraz
parent a023598e0d
commit 7e60c6ed41
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
api/permissions.py
View file

@ -239,6 +239,9 @@ class AutodetectACLPermission(permissions.BasePermission):
if getattr(view, "_ignore_model_permissions", False):
return True
if not getattr(view, "queryset", getattr(view, "get_queryset", None)):
return True
if not request.user or not request.user.is_authenticated:
return False
@ -273,7 +276,8 @@ class AutodetectACLPermission(permissions.BasePermission):
# they have read permissions to see 403, or not, and simply see
# a 404 response.
SAFE_METHODS = ("GET", "OPTIONS", "HEAD", "POST", "PUT", "PATCH", "DELETE")
SAFE_METHODS = ("GET", "OPTIONS", "HEAD",
"POST", "PUT", "PATCH", "DELETE")
if request.method in SAFE_METHODS:
# Read permissions already checked and failed, no need