encode/django-rest-framework
1
1
Fork 0
mirror of https://github.com/encode/django-rest-framework.git synced 2025-07-30 01:49:50 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(composable permissions): no more double level OR

Browse Source 
* POC to demonstrate a quick fix to prevent the double level `OR` permission check
This commit is contained in:
Florent Chehab 2019-04-06 11:09:17 +02:00
parent 29cbe574a3
commit c86f5463b4
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
rest_framework/permissions.py
View File

@ -80,9 +80,12 @@ class OR:
)
def has_object_permission(self, request, view, obj):
# We enforce a "block" `OR`, so we need the result of `has_permission` too.
op1_hp_res = self.op1.has_permission(request, view)
op2_hp_res = self.op2.has_permission(request, view)
return (
self.op1.has_object_permission(request, view, obj) or
self.op2.has_object_permission(request, view, obj)
(op1_hp_res and self.op1.has_object_permission(request, view, obj)) or
(op2_hp_res and self.op2.has_object_permission(request, view, obj))
)

7
tests/test_permissions.py
View File

@ -580,6 +580,13 @@ class PermissionsCompositionTests(TestCase):
composed_perm = permissions.IsAuthenticated | permissions.AllowAny
assert composed_perm().has_permission(request, None) is True
def test_or_as_block(self):
request = factory.get('/1', format='json')
request.user = AnonymousUser()
composed_perm = BasicObjectPerm | permissions.IsAuthenticated
assert composed_perm().has_permission(request, None) is True
assert composed_perm().has_object_permission(request, None, None) is False
def test_not_false(self):
request = factory.get('/1', format='json')
request.user = AnonymousUser()