The original semantic of OR is defined as: the request pass either of the two has_permission() check, and pass either of the two has_object_permission() check, which could lead to situations that a request passes has_permission() but fails on has_object_permission() of Permission Class A, fails has_permission() but passes has_object_permission() of Permission Class B, passes the OR permission check. This should not be the desired permission check semantic in applications, because such a request should fail on either Permission Class (on Django object permission) alone, but passes the OR or the two.
My code fix this by changing the semantic so that the request has to pass either class's has_permission() and has_object_permission() to get the Django object permission of the OR check.
* Add drf-psq to third party packages
* Add drf-psq to permissions.md
this package is an extension that gives support for having action-based **permission_classes**, **serializer_class**, and **queryset** dependent on permission-based rules.
Co-authored-by: Salar Nasiri <salarnasiri@users.noreply.github.com>
* url() is deprecated in Django 3.1
* update given feedbacks on url() is deprecated in Django 3.1
* Fix test_urlpatterns.py to continue testing mixed re_path() and path()
* Fix one missed reference
Co-authored-by: sanjusci <sanju.sci9@gmail.com>
Django 3.1 adds a new generic JSONField to replace the PostgreSQL-specific one. This adds support for the new field type, which should behave the same as the existing PostgreSQL field.
Django's new JSONField also includes support for a custom "decoder", so add support for that in the serializer field.
* Adjusted token admin to map to user ID.
Closes#6131.
* Adds a proxy model for Token that uses the user.pk, rather than it's own.
* Adjusts Admin to map back from User ID to token instance.
* Update sponsors
Co-authored-by: Carlton Gibson <carlton.gibson@noumenal.es>
* Make `NullBooleanField` subclass `BooleanField`
This removes a lot of the redundancy that was in place becuase we
were not doing this. This maintains the `None` initial value that
was previously present, as well as disallowing `allow_null` to be
passed in.
* Remove special case for mapping `NullBooleanField`
In newer versions of Django, the `NullBooleanField` is handled the
same way as a `BooleanField(null=True)`. Given that we also support
that combination, and that our own `NullBooleanField` behaves in the
same manner, it makes sense to remove the special casing that exists
for it.
* Add test for BooleanField(null=True, choices)
* Remove special case for NullBooleanField
* Adjust mapping tests for NullBooleanField
* Fixed linting error
* Raise deprecation warning when NullBooleanField is used
* Fix linting issue in imports
* Fix ModelSerializer unique_together field sources
Updates ModelSerializer to check for serializer fields that map to the
model field sources in the unique_together lists.
* Ensure field name ordering consistency
* Update README.md
We should use path instead of url in urlpatterns,
* Update index.md
We should use path instead of url in urlpatterns
* Update README.md
We should use path instead of url in urlpatterns
