CODEWITHSUNDEEP
djangodjango-rest-frameworkdjango-mongodb-engine
Fabiot
Fabiot

Reputation: 449

Problems with Django rest-framework DjangoModelPermissions allowing any authenticated user

I am trying to use DjangoModelPermissions and it does not seem to work properly.

This is the code:

class TestViewSet(viewsets.ModelViewSet):
    model = Test
    serializer_class = serializers.TestSerializer
    permission_classes = (permissions.DjangoModelPermissions,)

    def create(self, request):
        response_data = {}
        response_data['type'] = 'error'
        data=json.loads(request.raw_post_data)

        test = Test.objects.create(name=data['name'],\
                                            description=data['description'],\
                                            start_date=data['start_date'],\
                                            end_date=data['end_date'])          

        #save changes
        test.save()
        return Response({'status': 'ok', "result": test.id})

I don't think it makes any difference in this case but I am using django_mongodb_engine.

I have a user that has no permissions, and it is able to create Test instances. On the other hand, how can I block also GET so just users with the right permissions can perform that action?

Thanks

Upvotes: 9

Views: 1965

Answers (3)

RaamVijay
RaamVijay

Reputation: 31

The reason for DjangoModelPermissions is not working here is clearly explained in the DRF docs

"This permission must only be applied to views that have a .queryset property or get_queryset() method."

Check the docs here

The solution is:

Add queryset to your model

class TestViewSet(viewsets.ModelViewSet):
   serializer_class = serializers.TestSerializer
   permission_classes = (permissions.DjangoModelPermissions,)
   queryset = Test.objects.all()

or if you want to override the default queryset method use this method as you like

 def get_queryset(self):
    return super().get_queryset()

Also, I noticed you don't have to specify the model in your ModelViewSet. If you specify your Test model in TestSerializer you only have to specify the serializer in ModelViewSet that's how DRF works

Upvotes: 1

hof.and.or
hof.and.or

Reputation: 164

My problem was the same. The user could create new instance in the database despite of the permission class. I looked into the django-guardian and found that this back-end should be default:

AUTHENTICATION_BACKENDS = (
    'django.contrib.auth.backends.ModelBackend',
)

So I added it in my settings.py file and now it works and a user without a permission cannot create new instance. I hope it helps.

Upvotes: 0

timop
timop

Reputation: 942

You need to have django-guardian with DRF for DjangoModelPermissions to work correctly. It's also mentioned in the original docs http://www.django-rest-framework.org/api-guide/permissions under the DjangoModelPermissions paragraph

If it still doesn't work as it should then let us know

Upvotes: -2

Related Questions