Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Ensure Django{Model,Object}Permissions don't hide exceptions.
Quietly catching `AttributeError` and `TypeError` when calling
`get_queryset()` is rather insidious, as those exceptions get caught no
matter where they might happen in the call stack.
  • Loading branch information
akx committed Nov 27, 2015
commit 69688289ce22c874a430910a0b85c0d5a68d1f3c
16 changes: 8 additions & 8 deletions rest_framework/permissions.py
Original file line number Diff line number Diff line change
Expand Up @@ -112,15 +112,15 @@ def has_permission(self, request, view):
if getattr(view, '_ignore_model_permissions', False):
return True

try:
if hasattr(view, 'get_queryset'):
queryset = view.get_queryset()
except AttributeError:
else:
queryset = getattr(view, 'queryset', None)

assert queryset is not None, (
'Cannot apply DjangoModelPermissions on a view that '
'does not have `.queryset` property or overrides the '
'`.get_queryset()` method.')
'does not set `.queryset` or have a `.get_queryset()` method.'
)

perms = self.get_required_permissions(request.method, queryset.model)

Expand Down Expand Up @@ -169,15 +169,15 @@ def get_required_object_permissions(self, method, model_cls):
return [perm % kwargs for perm in self.perms_map[method]]

def has_object_permission(self, request, view, obj):
try:
if hasattr(view, 'get_queryset'):
queryset = view.get_queryset()
except AttributeError:
else:
queryset = getattr(view, 'queryset', None)

assert queryset is not None, (
'Cannot apply DjangoObjectPermissions on a view that '
'does not have `.queryset` property or overrides the '
'`.get_queryset()` method.')
'does not set `.queryset` or have a `.get_queryset()` method.'
)

model_cls = queryset.model
user = request.user
Expand Down