Question

我使用django 1.11，

如果我在shell中调用request.user.has_perm（“ auth.add_user”），则返回true。但是如果我在视图中调用它，则返回false，

所有数据库许可关系都可以。我尝试使用get_object_or_404方法来从db获取用户以避免缓存。但不起作用

# shell
>>> user = User.objects.get(pk=497)
>>> user.has_perms(["auth.add_user"])
(u'has perm', True)
True

这是我的权限等级

class DjangoModelPermissionsV2(BasePermission):

    perms_map = {
        'GET': ['%(app_label)s.view_%(model_name)s'],
        'OPTIONS': [],
        'HEAD': [],
        'POST': ['%(app_label)s.add_%(model_name)s'],
        'PUT': ['%(app_label)s.change_%(model_name)s'],
        'PATCH': ['%(app_label)s.change_%(model_name)s'],
        'DELETE': ['%(app_label)s.delete_%(model_name)s'],
    }

    authenticated_users_only = True

    def get_required_permissions(self, method, model_cls):
        kwargs = {
            'app_label': model_cls._meta.app_label,
            'model_name': model_cls._meta.model_name
        }

        return [perm % kwargs for perm in self.perms_map[method]]

    def has_permission(self, request, view):


        if getattr(view, '_ignore_model_permissions', False):
            return True

        if request.user and request.user.is_authenticated() or not self.authenticated_users_only:
            if hasattr(view, 'get_queryset'):
                queryset = view.get_queryset()
            else:
                queryset = getattr(view, 'queryset', None)

        else:
            return request.user and request.user.is_authenticated() or not self.authenticated_users_only

        assert queryset is not None, (
            'Cannot apply DjangoModelPermissions on a view that '
            'does not set `.queryset` or have a `.get_queryset()` method.'
        )

        perms = self.get_required_permissions(request.method, queryset.model)


        return (
            request.user.is_authenticated() and request.user.has_perms(perms)
        )

        # requset.user.has_perms return False

设置文件

REST_FRAMEWORK = {
    # Use Django's standard `django.contrib.auth` permissions,
    # or allow read-only access for unauthenticated users.
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.IsAuthenticated',
        'rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly',
#         'rest_framework.permissions.AllowAny',

    ],
    'DEFAULT_AUTHENTICATION_CLASSES': [
       'rest_framework.authentication.BasicAuthentication',
       'rest_framework.authentication.SessionAuthentication',
       'oauth2_provider.ext.rest_framework.OAuth2Authentication',
    ],
    'DEFAULT_PAGINATION_CLASS': 'rest_framework.pagination.LimitOffsetPagination' ,
#     'PAGE_SIZE': 100
    'DEFAULT_PARSER_CLASSES': [
        'rest_framework.parsers.FormParser',
        'rest_framework.parsers.MultiPartParser',
        'rest_framework.parsers.JSONParser',
    ]
}

AUTHENTICATION_BACKENDS = [
    'pgshop.custom_authenticate.CustomAuthenticate',
    'django.contrib.auth.backends.ModelBackend',  
]

Django has_perm方法始终返回false

0 个答案: