diff --git a/api/permissions.py b/api/permissions.py index 5ef3e4ac4..37eaf0b8e 100644 --- a/api/permissions.py +++ b/api/permissions.py @@ -1,10 +1,21 @@ from tastypie.authorization import Authorization +from tastypie.exceptions import Unauthorized class SuperuserAuthorization(Authorization): - + + # This implementation is supported only in versions 0.9.11 and below... + """ def is_authorized(self, request, object=None): return request.user.is_superuser def apply_limits(self, request, object_list): - return object_list + return object_list""" + + # Implementation in versions 0.9.12 and up. + def read_list(self, object_list, bundle): + # Is the person who made the request, superuser? + if bundle.request.user.is_superuser: + return object_list + else: + raise Unauthorized("Sorry, only VIP.") diff --git a/userprofile/api.py b/userprofile/api.py index 7fd0f4917..7d6245217 100644 --- a/userprofile/api.py +++ b/userprofile/api.py @@ -3,7 +3,6 @@ from api.permissions import SuperuserAuthorization from userprofile.models import UserProfile - class UserProfileResource(ModelResource): def dehydrate(self, bundle): @@ -27,4 +26,5 @@ class Meta: # In this version of the API only superusers are allowed to access # userprofile objects allowed_methods = ['get'] + authorization = SuperuserAuthorization()