From 7018784b7870753c5a8b098f64638bef5308c9b2 Mon Sep 17 00:00:00 2001 From: Mark Yu Date: Wed, 24 Apr 2019 22:25:37 +0800 Subject: [PATCH 1/4] Change semantic of OR of two permission classes The original semantic of OR is defined as: the request pass either of the two has_permission() check, and pass either of the two has_object_permission() check, which could lead to situations that a request passes has_permission() but fails on has_object_permission() of Permission Class A, fails has_permission() but passes has_object_permission() of Permission Class B, passes the OR permission check. This should not be the desired permission check semantic in applications, because such a request should fail on either Permission Class (on Django object permission) alone, but passes the OR or the two. My code fix this by changing the semantic so that the request has to pass either class's has_permission() and has_object_permission() to get the Django object permission of the OR check. --- rest_framework/permissions.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rest_framework/permissions.py b/rest_framework/permissions.py index 5d75f54bad..56ed5af5df 100644 --- a/rest_framework/permissions.py +++ b/rest_framework/permissions.py @@ -81,8 +81,9 @@ def has_permission(self, request, view): def has_object_permission(self, request, view, obj): return ( - self.op1.has_object_permission(request, view, obj) or - self.op2.has_object_permission(request, view, obj) + (self.op1.has_permission(request, view) and self.op1.has_object_permission(request, view, obj)) + or + (self.op2.has_permission(request, view) and self.op2.has_object_permission(request, view, obj)) ) From f34bf9a5fdb55085b2f6d0adc08cc0094e155de2 Mon Sep 17 00:00:00 2001 From: Tom Christie Date: Fri, 3 Sep 2021 14:22:53 +0100 Subject: [PATCH 2/4] Update permissions.py --- rest_framework/permissions.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/rest_framework/permissions.py b/rest_framework/permissions.py index 56ed5af5df..7ad18ce3dd 100644 --- a/rest_framework/permissions.py +++ b/rest_framework/permissions.py @@ -81,9 +81,11 @@ def has_permission(self, request, view): def has_object_permission(self, request, view, obj): return ( - (self.op1.has_permission(request, view) and self.op1.has_object_permission(request, view, obj)) - or - (self.op2.has_permission(request, view) and self.op2.has_object_permission(request, view, obj)) + self.op1.has_permission(request, view) + and self.op1.has_object_permission(request, view, obj) + ) or ( + self.op2.has_permission(request, view) + and self.op2.has_object_permission(request, view, obj) ) From 6fd656babf29887a34894489b1f051358c94fcdc Mon Sep 17 00:00:00 2001 From: Tom Christie Date: Fri, 1 Jul 2022 09:59:09 +0100 Subject: [PATCH 3/4] Update permissions.py --- rest_framework/permissions.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rest_framework/permissions.py b/rest_framework/permissions.py index 7ad18ce3dd..30d844096b 100644 --- a/rest_framework/permissions.py +++ b/rest_framework/permissions.py @@ -8,7 +8,7 @@ from rest_framework import exceptions -SAFE_METHODS = ('GET', 'HEAD', 'OPTIONS') +SAFE_METHODS = ('GET', 'HEAD','OPTIONS') class OperationHolderMixin: From 0ceb84bf76aee744c156ca0519ba158cd2075775 Mon Sep 17 00:00:00 2001 From: Tom Christie Date: Fri, 1 Jul 2022 09:59:43 +0100 Subject: [PATCH 4/4] Update permissions.py --- rest_framework/permissions.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rest_framework/permissions.py b/rest_framework/permissions.py index 30d844096b..7ad18ce3dd 100644 --- a/rest_framework/permissions.py +++ b/rest_framework/permissions.py @@ -8,7 +8,7 @@ from rest_framework import exceptions -SAFE_METHODS = ('GET', 'HEAD','OPTIONS') +SAFE_METHODS = ('GET', 'HEAD', 'OPTIONS') class OperationHolderMixin: