encode/django-rest-framework
1
1
Fork 0
mirror of https://github.com/encode/django-rest-framework.git synced 2025-02-03 13:14:30 +03:00
Code Issues Packages Projects Releases Wiki Activity

Improve docstring on DjangoModelPermissions, and also ensure the user is authenticated.

Browse Source
This commit is contained in:
Tom Christie 2012-02-11 18:29:24 +00:00
parent 2c11fd68f8
commit cb8d94b956
1 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
djangorestframework/permissions.py
View File

@ -91,15 +91,18 @@ class IsUserOrIsAnonReadOnly(BasePermission):
class DjangoModelPermissions(BasePermission): class DjangoModelPermissions(BasePermission):
""" """
The request is authenticated against the Django user's permissions on the The request is authenticated using `django.contrib.auth` permissions.
`Resource`'s `Model`. See: https://docs.djangoproject.com/en/dev/topics/auth/#permissions
This permission should only be used on views with a `ModelResource`. It ensures that the user is authenticated, and has the appropriate
`add`/`change`/`delete` permissions on the model.
This permission should only be used on views with a `ModelResource`.
""" """
# Map methods into required permission codes. # Map methods into required permission codes.
# Override this if you need to also provide 'read' permissions, # Override this if you need to also provide 'read' permissions,
# or other custom behaviour. # or if you want to provide custom permisson codes.
perms_map = { perms_map = {
'GET': [], 'GET': [],
'OPTIONS': [], 'OPTIONS': [],
@ -117,7 +120,7 @@ class DjangoModelPermissions(BasePermission):
""" """
kwargs = { kwargs = {
'app_label': model_cls._meta.app_label, 'app_label': model_cls._meta.app_label,
'model_name': model_cls.__name__.lower() 'model_name': model_cls._meta.module_name
} }
try: try:
return [perm % kwargs for perm in self.perms_map[method]] return [perm % kwargs for perm in self.perms_map[method]]
@ -129,7 +132,7 @@ class DjangoModelPermissions(BasePermission):
model_cls = self.view.resource.model model_cls = self.view.resource.model
perms = self.get_required_permissions(method, model_cls) perms = self.get_required_permissions(method, model_cls)
if not user.has_perms(perms): if not user.is_authenticated or not user.has_perms(perms):
raise _403_FORBIDDEN_RESPONSE raise _403_FORBIDDEN_RESPONSE