Skip to content

Commit

Permalink
Superuser validation fixed for this version of Tastypie
Browse files Browse the repository at this point in the history
  • Loading branch information
Ville Vironmäki committed Apr 14, 2016
1 parent 57982bf commit eb35068
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 3 deletions.
15 changes: 13 additions & 2 deletions api/permissions.py
Original file line number Diff line number Diff line change
@@ -1,10 +1,21 @@
from tastypie.authorization import Authorization
from tastypie.exceptions import Unauthorized


class SuperuserAuthorization(Authorization):


# This implementation is supported only in versions 0.9.11 and below...
"""
def is_authorized(self, request, object=None):
return request.user.is_superuser
def apply_limits(self, request, object_list):
return object_list
return object_list"""

# Implementation in versions 0.9.12 and up.
def read_list(self, object_list, bundle):
# Is the person who made the request, superuser?
if bundle.request.user.is_superuser:
return object_list
else:
raise Unauthorized("Sorry, only VIP.")
2 changes: 1 addition & 1 deletion userprofile/api.py
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
from api.permissions import SuperuserAuthorization
from userprofile.models import UserProfile


class UserProfileResource(ModelResource):

def dehydrate(self, bundle):
Expand All @@ -27,4 +26,5 @@ class Meta:
# In this version of the API only superusers are allowed to access
# userprofile objects
allowed_methods = ['get']

authorization = SuperuserAuthorization()

0 comments on commit eb35068

Please sign in to comment.