Archived
23 lines
842 B
Python
23 lines
842 B
Python
from tastypie.authorization import DjangoAuthorization
|
|
from tastypie.exceptions import Unauthorized
|
|
|
|
class MyDjangoAuthorization(DjangoAuthorization):
|
|
|
|
def update_detail(self, object_list, bundle):
|
|
klass = self.base_checks(bundle.request, bundle.obj.__class__)
|
|
|
|
if klass is False:
|
|
raise Unauthorized("You are not allowed to access that resource.")
|
|
|
|
# Skip permission check if the request is made by the object owner
|
|
# Note: Standard DjangoAuthorization does not have this check
|
|
if bundle.obj == bundle.request.user:
|
|
return True
|
|
|
|
permission = '%s.change_%s' % (klass._meta.app_label, klass._meta.module_name)
|
|
|
|
if not bundle.request.user.has_perm(permission):
|
|
raise Unauthorized("You are not allowed to access that resource.")
|
|
|
|
return True
|