encode/django-rest-framework
1
1
Fork 0
mirror of https://github.com/encode/django-rest-framework.git synced 2025-07-30 18:09:59 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(composable permissions): no more double level OR

Browse Source 
* POC to demonstrate a quick fix to prevent the double level `OR` permission check
This commit is contained in:
Florent Chehab 2019-04-06 11:09:17 +02:00
parent 29cbe574a3
commit c86f5463b4
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
rest_framework/permissions.py
View File

@ -80,9 +80,12 @@ class OR:
) )
def has_object_permission(self, request, view, obj): def has_object_permission(self, request, view, obj):
# We enforce a "block" `OR`, so we need the result of `has_permission` too.
op1_hp_res = self.op1.has_permission(request, view)
op2_hp_res = self.op2.has_permission(request, view)
return ( return (
self.op1.has_object_permission(request, view, obj) or (op1_hp_res and self.op1.has_object_permission(request, view, obj)) or
self.op2.has_object_permission(request, view, obj) (op2_hp_res and self.op2.has_object_permission(request, view, obj))
) )

7
tests/test_permissions.py
View File

@ -580,6 +580,13 @@ class PermissionsCompositionTests(TestCase):
composed_perm = permissions.IsAuthenticated | permissions.AllowAny composed_perm = permissions.IsAuthenticated | permissions.AllowAny
assert composed_perm().has_permission(request, None) is True assert composed_perm().has_permission(request, None) is True
def test_or_as_block(self):
request = factory.get('/1', format='json')
request.user = AnonymousUser()
composed_perm = BasicObjectPerm | permissions.IsAuthenticated
assert composed_perm().has_permission(request, None) is True
assert composed_perm().has_object_permission(request, None, None) is False
def test_not_false(self): def test_not_false(self):
request = factory.get('/1', format='json') request = factory.get('/1', format='json')
request.user = AnonymousUser() request.user = AnonymousUser()