encode/django-rest-framework
1
1
Fork 0
mirror of https://github.com/encode/django-rest-framework.git synced 2025-08-04 12:30:11 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge ed6a14058a into 836e49b535

Browse Source
This commit is contained in:
Chris Scanlin 2017-06-06 20:17:39 +00:00 committed by GitHub
commit 5c8ae71ab3
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
rest_framework/permissions.py
View File

@ -158,6 +158,9 @@ class DjangoObjectPermissions(DjangoModelPermissions):
This permission can only be applied against view classes that This permission can only be applied against view classes that
provide a `.queryset` attribute. provide a `.queryset` attribute.
""" """
requires_object_permission = True
perms_map = { perms_map = {
'GET': [], 'GET': [],
'OPTIONS': [], 'OPTIONS': [],

5
rest_framework/views.py
View File

@ -8,6 +8,7 @@ from django.core.exceptions import PermissionDenied
from django.db import models from django.db import models
from django.http import Http404 from django.http import Http404
from django.http.response import HttpResponseBase from django.http.response import HttpResponseBase
from django.shortcuts import get_object_or_404 as _get_object_or_404
from django.utils import six from django.utils import six
from django.utils.cache import cc_delim_re, patch_vary_headers from django.utils.cache import cc_delim_re, patch_vary_headers
from django.utils.encoding import smart_text from django.utils.encoding import smart_text
@ -392,6 +393,10 @@ class APIView(View):
# Ensure that the incoming request is permitted # Ensure that the incoming request is permitted
self.perform_authentication(request) self.perform_authentication(request)
if getattr(self, 'requires_object_permission', None) and 'pk' in kwargs:
obj = _get_object_or_404(self.get_queryset(), pk=kwargs['pk'])
self.check_object_permissions(request, obj)
else:
self.check_permissions(request) self.check_permissions(request)
self.check_throttles(request) self.check_throttles(request)