From 91f12360d0caf9dc8ceec6efef4042f974e96d8d Mon Sep 17 00:00:00 2001 From: Ben Buchwald Date: Thu, 6 May 2021 18:25:01 -0400 Subject: [PATCH] ORing object permissions falls back to has_permission if no object permission Composing permissions with OR should fall back on has_permission when has_object_permission isn't implemented. If has_object_permission is not implemented, than its has_permission should apply to all objects. Strictly speaking, BasePermission.has_object_permission could return self.has_permission(request, view), but only in the OR case is it possible that wasn't already true, so only doing that fallback in the OR case saves some redundant calls to has_permission. --- rest_framework/permissions.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/rest_framework/permissions.py b/rest_framework/permissions.py index 91d8957d2..437e9036d 100644 --- a/rest_framework/permissions.py +++ b/rest_framework/permissions.py @@ -81,9 +81,13 @@ class OR: def has_object_permission(self, request, view, obj): hasperm1 = self.op1.has_object_permission(request, view, obj) + if hasperm1 is NotImplemented: + hasperm1 = self.op1.has_permission(request, view) if hasperm1 and hasperm1 is not NotImplemented: return hasperm1 hasperm2 = self.op2.has_object_permission(request, view, obj) + if hasperm2 is NotImplemented: + hasperm2 = self.op2.has_permission(request, view) return hasperm1 if hasperm2 is NotImplemented else hasperm2