NeoAnd/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2025-07-16 04:02:52 -06:00
Code Issues Actions 7 Packages Projects Releases Wiki Activity

Override has_permission and has_object_permission

Browse Source
This commit is contained in:
Daniel Sheppard 2024-06-18 10:24:56 -05:00
parent 38786748b7
commit 725db7b16e
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
netbox/netbox/api/authentication.py
View File

@ -3,7 +3,7 @@ import logging
from django.conf import settings from django.conf import settings
from django.utils import timezone from django.utils import timezone
from rest_framework import authentication, exceptions from rest_framework import authentication, exceptions
from rest_framework.permissions import BasePermission, DjangoObjectPermissions, SAFE_METHODS from rest_framework.permissions import BasePermission, DjangoObjectPermissions, SAFE_METHODS, DjangoModelPermissions
from netbox.config import get_config from netbox.config import get_config
from users.models import Token from users.models import Token
@ -103,14 +103,10 @@ class TokenPermissions(DjangoObjectPermissions):
super().__init__() super().__init__()
def _verify_write_permission(self, request): def _verify_write_permission(self, request):
# Determine if this permission set allows read-only tokens
allow_readonly_token = getattr(self, 'allow_readonly_token', False)
# If token authentication is in use, verify that the token allows write operations (for unsafe methods). # If token authentication is in use, verify that the token allows write operations (for unsafe methods).
# If this permission set allows read-only tokens, also permit access # If this permission set allows read-only tokens, also permit access
if request.method in SAFE_METHODS or request.auth.write_enabled or ( if request.method in SAFE_METHODS or request.auth.write_enabled:
not request.auth.write_enabled and allow_readonly_token
):
return True return True
def has_permission(self, request, view): def has_permission(self, request, view):
@ -155,7 +151,11 @@ class RequireViewOnlyPermissions(TokenPermissions):
'DELETE': ['%(app_label)s.view_%(model_name)s'], 'DELETE': ['%(app_label)s.view_%(model_name)s'],
} }
allow_readonly_token = True def has_permission(self, request, view):
return super(DjangoModelPermissions, self).has_permission(request, view)
def has_object_permission(self, request, view, obj):
return super(DjangoObjectPermissions, self).has_permission(request, view)
class IsAuthenticatedOrLoginNotRequired(BasePermission): class IsAuthenticatedOrLoginNotRequired(BasePermission):