From d995742afc09ff8d387751a6fe47b9686845740b Mon Sep 17 00:00:00 2001
From: Tom Christie <tom@tomchristie.com>
Date: Sat, 27 Oct 2012 20:04:33 +0100
Subject: [PATCH 1/2] Add AllowAny permission

---
 docs/api-guide/permissions.md | 12 ++++++++++++
 docs/api-guide/settings.md    |  6 +++++-
 rest_framework/settings.py    |  9 ++++++---
 3 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/docs/api-guide/permissions.md b/docs/api-guide/permissions.md
index 0b7b32e93..d43b7bedc 100644
--- a/docs/api-guide/permissions.md
+++ b/docs/api-guide/permissions.md
@@ -33,6 +33,12 @@ The default permission policy may be set globally, using the `DEFAULT_PERMISSION
         )
     }
 
+If not specified, this setting defaults to allowing unrestricted access:
+
+    'DEFAULT_PERMISSION_CLASSES': (
+       'rest_framework.permissions.AllowAny',
+    )
+
 You can also set the authentication policy on a per-view basis, using the `APIView` class based views.
 
     class ExampleView(APIView):
@@ -58,6 +64,12 @@ Or, if you're using the `@api_view` decorator with function based views.
 
 # API Reference
 
+## AllowAny
+
+The `AllowAny` permission class will allow unrestricted access, **regardless of if the request was authenticated or unauthenticated**.
+
+This permission is not strictly required, since you can achieve the same result by using an empty list or tuple for the permissions setting, but you may find it useful to specify this class because it makes the intention explicit.
+
 ## IsAuthenticated
 
 The `IsAuthenticated` permission class will deny permission to any unauthenticated user, and allow permission otherwise.
diff --git a/docs/api-guide/settings.md b/docs/api-guide/settings.md
index 21efc853e..3556a5b14 100644
--- a/docs/api-guide/settings.md
+++ b/docs/api-guide/settings.md
@@ -72,7 +72,11 @@ Default:
 
 A list or tuple of permission classes, that determines the default set of permissions checked at the start of a view.
 
-Default: `()`
+Default:
+
+    (
+        'rest_framework.permissions.AllowAny',
+    )
 
 ## DEFAULT_THROTTLE_CLASSES
 
diff --git a/rest_framework/settings.py b/rest_framework/settings.py
index 3c5082943..9c40a2144 100644
--- a/rest_framework/settings.py
+++ b/rest_framework/settings.py
@@ -37,11 +37,14 @@ DEFAULTS = {
         'rest_framework.authentication.SessionAuthentication',
         'rest_framework.authentication.BasicAuthentication'
     ),
-    'DEFAULT_PERMISSION_CLASSES': (),
-    'DEFAULT_THROTTLE_CLASSES': (),
+    'DEFAULT_PERMISSION_CLASSES': (
+        'rest_framework.permissions.AllowAny',
+    ),
+    'DEFAULT_THROTTLE_CLASSES': (
+    ),
+
     'DEFAULT_CONTENT_NEGOTIATION_CLASS':
         'rest_framework.negotiation.DefaultContentNegotiation',
-
     'DEFAULT_MODEL_SERIALIZER_CLASS':
         'rest_framework.serializers.ModelSerializer',
     'DEFAULT_PAGINATION_SERIALIZER_CLASS':

From af96fe05d0138c34128fc3944fc2701cbad5bd01 Mon Sep 17 00:00:00 2001
From: Tom Christie <tom@tomchristie.com>
Date: Sat, 27 Oct 2012 20:17:49 +0100
Subject: [PATCH 2/2] Add AllowAny class

---
 rest_framework/permissions.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/rest_framework/permissions.py b/rest_framework/permissions.py
index 51e961963..655b78a34 100644
--- a/rest_framework/permissions.py
+++ b/rest_framework/permissions.py
@@ -18,6 +18,17 @@ class BasePermission(object):
         raise NotImplementedError(".has_permission() must be overridden.")
 
 
+class AllowAny(BasePermission):
+    """
+    Allow any access.
+    This isn't strictly required, since you could use an empty
+    permission_classes list, but it's useful because it makes the intention
+    more explicit.
+    """
+    def has_permission(self, request, view, obj=None):
+        return True
+
+
 class IsAuthenticated(BasePermission):
     """
     Allows access only to authenticated users.