You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/api-guide/permissions.md
+1-7Lines changed: 1 addition & 7 deletions
Original file line number
Diff line number
Diff line change
@@ -169,7 +169,7 @@ This permission is suitable if you want to your API to allow read permissions to
169
169
170
170
## DjangoModelPermissions
171
171
172
-
This permission class ties into Django's standard `django.contrib.auth`[model permissions][contribauth]. This permission must only be applied to views that have a `.queryset` property set. Authorization will only be granted if the user *is authenticated* and has the *relevant model permissions* assigned.
172
+
This permission class ties into Django's standard `django.contrib.auth`[model permissions][contribauth]. This permission must only be applied to views that have a `.queryset` property or `get_queryset()` method. Authorization will only be granted if the user *is authenticated* and has the *relevant model permissions* assigned.
173
173
174
174
*`POST` requests require the user to have the `add` permission on the model.
175
175
*`PUT` and `PATCH` requests require the user to have the `change` permission on the model.
@@ -179,12 +179,6 @@ The default behaviour can also be overridden to support custom model permissions
179
179
180
180
To use custom model permissions, override `DjangoModelPermissions` and set the `.perms_map` property. Refer to the source code for details.
181
181
182
-
#### Using with views that do not include a `queryset` attribute.
183
-
184
-
If you're using this permission with a view that uses an overridden `get_queryset()` method there may not be a `queryset` attribute on the view. In this case we suggest also marking the view with a sentinel queryset, so that this class can determine the required permissions. For example:
185
-
186
-
queryset = User.objects.none() # Required for DjangoModelPermissions
187
-
188
182
## DjangoModelPermissionsOrAnonReadOnly
189
183
190
184
Similar to `DjangoModelPermissions`, but also allows unauthenticated users to have read-only access to the API.
0 commit comments