-
-
Notifications
You must be signed in to change notification settings - Fork 7k
Fix the way DjangoModelPermissions asks for the model to be checked. #6310
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Extra blank line deleted at the end of test_permissions.py
What was the error message ? |
The error was the same with and without the queryset attribute suggested. That my user has not the role that I was checking in get_queryset. So if DjangoModelPermissions only uses the queryset to determine the model name, it is the same to obtain the queryset from the attribute or the method. |
Unfortunately this will not be consistent with how DRF works in general. |
I understand your point. |
@xordoquy I share a gist with my example of code that fails with the actual version of DjangoModelPermissions. |
In your gist, if the |
@xordoquy I know that raises an exception, but I have a custom permission class that verify that the user has a provider profile ( |
@xordoquy Hi, could you give me a response please? Thanks |
The original issue requires a documentation update to state that |
Description
DjangoModelPermissions always use the queryset from MyView.get_queryset() to extract the model name needed for permission verifications. In some cases, .get_queryset() method changes the queryset of the view depending on the conditions for a user.
In my particular case, I created a custom permission class that verifies if the user has a role, so in a APIView I modified the permission_classes in this order: [DjangoModelPermissions, MyCustomUserPermission]. When I was testing my view, I tried to access with a user that didn't have the role required, therefore the test failed because DjangoModelPermissions tried to obtain the queryset using get_queryset().
When I realized which the problem was, I referred to the DRF documentation finding:
DjangoModelPermissions
So, I added a queryset attribute with and empty queryset (suggested in the docs) but DjangoModelPermission continues to ask for get_queryset().
My solution to the problem was to modify DjangoModelPermissions._queryset() to always returning the queryset attribute defined in the view, if not, returning the queryset of get_queryset() method.