rezometz/re2o
8
0
Fork 0
mirror of https://gitlab2.federez.net/re2o/re2o synced 2024-11-22 11:23:10 +00:00
Code Issues Releases Wiki Activity

bypass temporaire des acl de l'api

Browse source
This commit is contained in:
chapeau 2020-11-28 12:06:32 +01:00
parent 935249bebd
commit e863179907
1 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
api/permissions.py
View file

@ -62,7 +62,7 @@ def _get_param_in_view(view, param_name):
"cannot apply {} on a view that does not set " "cannot apply {} on a view that does not set "
"`.{}` or have a `.get_{}()` method." "`.{}` or have a `.get_{}()` method."
).format( ).format(
self.__class__.__name__, param_name, param_name view.__class__.__name__, param_name, param_name
) )
if hasattr(view, "get_" + param_name): if hasattr(view, "get_" + param_name):
@ -212,7 +212,7 @@ class AutodetectACLPermission(permissions.BasePermission):
return [perm(obj) for perm in self.perms_obj_map[method]] return [perm(obj) for perm in self.perms_obj_map[method]]
@staticmethod @ staticmethod
def _queryset(view): def _queryset(view):
return _get_param_in_view(view, "queryset") return _get_param_in_view(view, "queryset")
@ -239,6 +239,9 @@ class AutodetectACLPermission(permissions.BasePermission):
if getattr(view, "_ignore_model_permissions", False): if getattr(view, "_ignore_model_permissions", False):
return True return True
if not getattr(view, "queryset", None):
return True
if not request.user or not request.user.is_authenticated: if not request.user or not request.user.is_authenticated:
return False return False
@ -273,7 +276,8 @@ class AutodetectACLPermission(permissions.BasePermission):
# they have read permissions to see 403, or not, and simply see # they have read permissions to see 403, or not, and simply see
# a 404 response. # a 404 response.
SAFE_METHODS = ("GET", "OPTIONS", "HEAD", "POST", "PUT", "PATCH", "DELETE") SAFE_METHODS = ("GET", "OPTIONS", "HEAD",
"POST", "PUT", "PATCH", "DELETE")
if request.method in SAFE_METHODS: if request.method in SAFE_METHODS:
# Read permissions already checked and failed, no need # Read permissions already checked and failed, no need