Version 2.3.3

3 files changed, 16 insertions, 8 deletions

diff --git a/rest_framework/__init__.py b/rest_framework/__init__.py
index b4961e2f..0b1e67fb 100644
--- a/rest_framework/__init__.py
+++ b/rest_framework/__init__.py
@@ -1,4 +1,4 @@
-__version__ = '2.3.2'
+__version__ = '2.3.3'
 
 VERSION = __version__  # synonym
 
diff --git a/rest_framework/permissions.py b/rest_framework/permissions.py
index 751f31a7..45fcfd66 100644
--- a/rest_framework/permissions.py
+++ b/rest_framework/permissions.py
@@ -126,6 +126,11 @@ class DjangoModelPermissions(BasePermission):
         if model_cls is None and queryset is not None:
             model_cls = queryset.model
 
+        # Workaround to ensure DjangoModelPermissions are not applied
+        # to the root view when using DefaultRouter.
+        if model_cls is None and getattr(view, '_ignore_model_permissions'):
+            return True
+
         assert model_cls, ('Cannot apply DjangoModelPermissions on a view that'
                            ' does not have `.model` or `.queryset` property.')
 
diff --git a/rest_framework/routers.py b/rest_framework/routers.py
index 76714fd0..dba104c3 100644
--- a/rest_framework/routers.py
+++ b/rest_framework/routers.py
@@ -16,6 +16,7 @@ For example, you might have a `urls.py` that looks something like this:
 from __future__ import unicode_literals
 
 from collections import namedtuple
+from rest_framework import views
 from rest_framework.compat import patterns, url
 from rest_framework.decorators import api_view
 from rest_framework.response import Response
@@ -217,14 +218,16 @@ class DefaultRouter(SimpleRouter):
         for prefix, viewset, basename in self.registry:
             api_root_dict[prefix] = list_name.format(basename=basename)
 
-        @api_view(('GET',))
-        def api_root(request, format=None):
-            ret = {}
-            for key, url_name in api_root_dict.items():
-                ret[key] = reverse(url_name, request=request, format=format)
-            return Response(ret)
+        class APIRoot(views.APIView):
+            _ignore_model_permissions = True
 
-        return api_root
+            def get(self, request, format=None):
+                ret = {}
+                for key, url_name in api_root_dict.items():
+                    ret[key] = reverse(url_name, request=request, format=format)
+                return Response(ret)
+
+        return APIRoot.as_view()
 
     def get_urls(self):
         """