encode/django-rest-framework
1
1
Fork 0
mirror of https://github.com/encode/django-rest-framework.git synced 2025-07-27 08:29:59 +03:00
Code Issues Packages Projects Releases Wiki Activity

ORing object permissions falls back to has_permission if no object permission

Browse Source 
Composing permissions with OR should fall back on has_permission when
has_object_permission isn't implemented. If has_object_permission is
not implemented, than its has_permission should apply to all objects.
Strictly speaking, BasePermission.has_object_permission could return
self.has_permission(request, view), but only in the OR case is it possible
that wasn't already true, so only doing that fallback in the OR case
saves some redundant calls to has_permission.
This commit is contained in:
Ben Buchwald 2021-05-06 18:25:01 -04:00
parent 0edc4d776b
commit 91f12360d0
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
rest_framework/permissions.py
View File

@ -81,9 +81,13 @@ class OR:
def has_object_permission(self, request, view, obj): def has_object_permission(self, request, view, obj):
hasperm1 = self.op1.has_object_permission(request, view, obj) hasperm1 = self.op1.has_object_permission(request, view, obj)
if hasperm1 is NotImplemented:
hasperm1 = self.op1.has_permission(request, view)
if hasperm1 and hasperm1 is not NotImplemented: if hasperm1 and hasperm1 is not NotImplemented:
return hasperm1 return hasperm1
hasperm2 = self.op2.has_object_permission(request, view, obj) hasperm2 = self.op2.has_object_permission(request, view, obj)
if hasperm2 is NotImplemented:
hasperm2 = self.op2.has_permission(request, view)
return hasperm1 if hasperm2 is NotImplemented else hasperm2 return hasperm1 if hasperm2 is NotImplemented else hasperm2