diff --git a/rest_framework/permissions.py b/rest_framework/permissions.py index 3a8c58064..a906fd089 100644 --- a/rest_framework/permissions.py +++ b/rest_framework/permissions.py @@ -78,8 +78,9 @@ class OR: def has_object_permission(self, request, view, obj): return ( - self.op1.has_object_permission(request, view, obj) or - self.op2.has_object_permission(request, view, obj) + (self.op1.has_permission(request, view) and self.op1.has_object_permission(request, view, obj)) + or + (self.op2.has_permission(request, view) and self.op2.has_object_permission(request, view, obj)) ) diff --git a/tests/test_permissions.py b/tests/test_permissions.py index a016089d7..19aba56a3 100644 --- a/tests/test_permissions.py +++ b/tests/test_permissions.py @@ -615,7 +615,6 @@ class PermissionsCompositionTests(TestCase): ) assert composed_perm().has_object_permission(request, None, None) is False - @pytest.mark.skipif(not PY36, reason="assert_called_once() not available") def test_or_lazyness(self): request = factory.get('/1', format='json') request.user = AnonymousUser()