12 lines
358 B
Python
12 lines
358 B
Python
|
from rest_framework import permissions
|
||
|
|
|
||
|
|
|
||
|
|
class IsAuthorOrReadOnly(permissions.BasePermission):
|
||
|
|
|
||
|
|
def has_object_permission(self, request, view, obj):
|
||
|
|
# Read permissions are allowed to any request
|
||
|
|
if request.method in permissions.SAFE_METHODS:
|
||
|
|
return True
|
||
|
|
|
||
|
|
return obj.author == request.user or request.user.is_superuser
|