如何在ModelViewSet的POST请求中设置权限

Question

使用ModelViewSet时如何编写自己的POST请求权限类？

我已经尝试编写自己的Permission_classe，但没有成功。即使我的权限类别返回false，它仍会授予对发布请求的访问权限

models.py

class Building(models.Model, HitCountMixin):
    user                = models.ForeignKey(User, on_delete=models.CASCADE) limit_choices_to=Q(country=2921044) | Q(country=798544), on_delete=models.SET_NULL) #<------------ Eltern Element
    name                = models.CharField(max_length=200, null=True, blank=True)
    description         = models.TextField(max_length=2000,null=True, blank=True)
    facilities          = models.TextField(max_length=2000, null=True, blank=True)
    ...

views.py

class BuildingImageViewSet(viewsets.ModelViewSet):
    """
    API endpoint that allows groups to be viewed or edited.
    """
    serializer_class = BuildingImageSerializer
    permission_classes = (permissions.IsAuthenticated, IsOwner,)

    def get_queryset(self):
        if self.request.user.is_authenticated:
            return     BuildingImage.objects.filter(building__user=self.request.user)
        return None

permissions.py

class IsOwner(permissions.BasePermission):

    def has_object_permission(self, request, view, obj):
        print("TEST")
        return False

urls.py

router = routers.DefaultRouter()
router.register(r'buildingimages', myrest_views.BuildingImageViewSet, base_name="buildingimage")

如果我尝试上载图像，那为什么呢？ 之所以对我的IsOwner权限类进行评估，是因为我可以在控制台中看到带有“ TEST”的打印行。

我的解决方案：

def has_permission(self, request, view):

    if view.action == 'create':
        building_url    = request.POST.get('building')
        building_path   = urlparse(building_url).path
        building_id     = resolve(building_path).kwargs['pk']
        building        = Building.objects.get(id=building_id)
        return building.user == request.user

    return True

Answer 1

使用了has_object_permission()传递类列表，您需要在has_permission()方法内编写代码。

permission_classes = [<class 'rest_framework.permissions.AllowAny'>]

您必须通过派生BasePermission类的类

permission.py

from rest_framework import permissions

class IsOwner(permissions.BasePermission):

     def has_permission(self, request, view):
         if <CONDITION>:
             return True
         else:
             return False