Skip to content

Rejecting anonymous in DjangoModelPermissions *before* the get_queryset call #5367

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Rejecting anonymous in DjangoModelPermissions *before* the get_queryset call #5367

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions rest_framework/permissions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,14 @@ def has_permission(self, request, view):
if getattr(view, '_ignore_model_permissions', False):
return True

# For `.get_queryset` to assume that anonymous check was passed
# when `authenticated_users_only` is `True`.
if (
not request.user or
(not is_authenticated(request.user) and self.authenticated_users_only)
):
return False

if hasattr(view, 'get_queryset'):
queryset = view.get_queryset()
assert queryset is not None, (
Expand All @@ -135,11 +143,7 @@ def has_permission(self, request, view):

perms = self.get_required_permissions(request.method, queryset.model)

return (
request.user and
(is_authenticated(request.user) or not self.authenticated_users_only) and
request.user.has_perms(perms)
)
return request.user.has_perms(perms)


class DjangoModelPermissionsOrAnonReadOnly(DjangoModelPermissions):
Expand Down
12 changes: 9 additions & 3 deletions tests/test_permissions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,11 +201,15 @@ def test_empty_view_does_not_assert(self):
self.assertEqual(response.status_code, status.HTTP_200_OK)

def test_calling_method_not_allowed(self):
request = factory.generic('METHOD_NOT_ALLOWED', '/')
request = factory.generic(
'METHOD_NOT_ALLOWED', '/', HTTP_AUTHORIZATION=self.permitted_credentials
)
response = root_view(request)
self.assertEqual(response.status_code, status.HTTP_405_METHOD_NOT_ALLOWED)

request = factory.generic('METHOD_NOT_ALLOWED', '/1')
request = factory.generic(
'METHOD_NOT_ALLOWED', '/1', HTTP_AUTHORIZATION=self.permitted_credentials
)
response = instance_view(request, pk='1')
self.assertEqual(response.status_code, status.HTTP_405_METHOD_NOT_ALLOWED)

Expand Down Expand Up @@ -396,7 +400,9 @@ def test_cannot_read_list_permissions(self):
self.assertListEqual(response.data, [])

def test_cannot_method_not_allowed(self):
request = factory.generic('METHOD_NOT_ALLOWED', '/')
request = factory.generic(
'METHOD_NOT_ALLOWED', '/', HTTP_AUTHORIZATION=self.credentials['readonly']
)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are the test changes necessary? The changes to DjangoModelPermissions seems like it wouldn't affect existing behavior.

Copy link
Contributor Author

@theoden-dd theoden-dd Aug 29, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately, yes. It was a surprise for me, too.

These tests became broken, since they used anonymous users (accidentally, I think) and started to retrieve "403 forbidden" instead of "405 not allowed". That's connected with the priority of permission checks, which is higher than most of other checks.

So, all I did - just changed users to authenticated ones in these tests.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will need to review it, but thanks for the explanation.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, it is possible to retain the existing behavior by moving the HTTP method check out of get_required_permissions() and into has_permission() before the request.user check.

That said, I think the test changes are appropriate, as I'd argue that users shouldn't really be relying on the permissions class to perform 405 checks. 405 checking should happen earlier during dispatch.

response = object_permissions_list_view(request)
self.assertEqual(response.status_code, status.HTTP_405_METHOD_NOT_ALLOWED)

Expand Down