diff options
| author | Filipe Ximenes | 2013-08-20 16:24:13 -0300 | 
|---|---|---|
| committer | Filipe Ximenes | 2013-08-20 16:24:13 -0300 | 
| commit | 1bf712341508b5d9aa07fb62f55b7e495278fabf (patch) | |
| tree | 8ce12c440976236a8e351b8a7e6b149237fb5279 /docs/api-guide/permissions.md | |
| parent | f84d4951bfcc8887d57ca5fa0321cfdbb18a9b6d (diff) | |
| download | django-rest-framework-1bf712341508b5d9aa07fb62f55b7e495278fabf.tar.bz2 | |
improving documentation about object level permissions #1049
Diffstat (limited to 'docs/api-guide/permissions.md')
| -rw-r--r-- | docs/api-guide/permissions.md | 7 | 
1 files changed, 7 insertions, 0 deletions
| diff --git a/docs/api-guide/permissions.md b/docs/api-guide/permissions.md index c6372f98..bb7343af 100644 --- a/docs/api-guide/permissions.md +++ b/docs/api-guide/permissions.md @@ -28,6 +28,13 @@ If you're writing your own views and want to enforce object level permissions,  you'll need to explicitly call the `.check_object_permissions(request, obj)` method on the view at the point at which you've retrieved the object.  This will either raise a `PermissionDenied` or `NotAuthenticated` exception, or simply return if the view has the appropriate permissions. +For example: + +    def get_object(self): +        obj = get_object_or_404(self.get_queryset()) +        self.check_object_permissions(self.request, obj) +        return obj +  ## Setting the permission policy  The default permission policy may be set globally, using the `DEFAULT_PERMISSION_CLASSES` setting.  For example. | 
