From 882f03789cc45c520493320cefa51555e0122fdb Mon Sep 17 00:00:00 2001 From: Nicolas Delaby Date: Wed, 22 Apr 2015 12:35:09 +0200 Subject: [PATCH] Allow DjangoObjectPermissions to use views that define get_queryset --- rest_framework/permissions.py | 2 +- tests/test_permissions.py | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/rest_framework/permissions.py b/rest_framework/permissions.py index 8fa7e4452..95b538429 100644 --- a/rest_framework/permissions.py +++ b/rest_framework/permissions.py @@ -172,7 +172,7 @@ class DjangoObjectPermissions(DjangoModelPermissions): return [perm % kwargs for perm in self.perms_map[method]] def has_object_permission(self, request, view, obj): - model_cls = view.queryset.model + model_cls = view.get_queryset().model user = request.user perms = self.get_required_object_permissions(request.method, model_cls) diff --git a/tests/test_permissions.py b/tests/test_permissions.py index 9225308c7..4a8a8ee8e 100644 --- a/tests/test_permissions.py +++ b/tests/test_permissions.py @@ -227,6 +227,18 @@ class ObjectPermissionListView(generics.ListAPIView): object_permissions_list_view = ObjectPermissionListView.as_view() +class GetQuerysetObjectPermissionInstanceView(generics.RetrieveUpdateDestroyAPIView): + serializer_class = BasicPermSerializer + authentication_classes = [authentication.BasicAuthentication] + permission_classes = [ViewObjectPermissions] + + def get_queryset(self): + return BasicPermModel.objects.all() + + +get_queryset_object_permissions_view = GetQuerysetObjectPermissionInstanceView.as_view() + + @unittest.skipUnless(guardian, 'django-guardian not installed') class ObjectPermissionsIntegrationTests(TestCase): """ @@ -326,6 +338,15 @@ class ObjectPermissionsIntegrationTests(TestCase): response = object_permissions_view(request, pk='1') self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND) + def test_can_read_get_queryset_permissions(self): + """ + same as ``test_can_read_permissions`` but with a view + that rely on ``.get_queryset()`` instead of ``.queryset``. + """ + request = factory.get('/1', HTTP_AUTHORIZATION=self.credentials['readonly']) + response = get_queryset_object_permissions_view(request, pk='1') + self.assertEqual(response.status_code, status.HTTP_200_OK) + # Read list def test_can_read_list_permissions(self): request = factory.get('/', HTTP_AUTHORIZATION=self.credentials['readonly'])