From e677f3ee5c9435594ce58a3256a119c08bdc1e42 Mon Sep 17 00:00:00 2001
From: Krzysztof Jurewicz
Date: Tue, 13 Aug 2013 13:26:30 +0200
Subject: PATCH requests should not be able to create objects.

---
 rest_framework/mixins.py              | 13 ++++++++-----
 rest_framework/tests/test_generics.py | 11 +++++++++++
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/rest_framework/mixins.py b/rest_framework/mixins.py
index f11def6d..59d64469 100644
--- a/rest_framework/mixins.py
+++ b/rest_framework/mixins.py
@@ -142,11 +142,14 @@ class UpdateModelMixin(object):
         try:
             return self.get_object()
         except Http404:
-            # If this is a PUT-as-create operation, we need to ensure that
-            # we have relevant permissions, as if this was a POST request.
-            # This will either raise a PermissionDenied exception,
-            # or simply return None
-            self.check_permissions(clone_request(self.request, 'POST'))
+            if self.request.method == 'PUT':
+                # For PUT-as-create operation, we need to ensure that we have
+                # relevant permissions, as if this was a POST request.  This
+                # will either raise a PermissionDenied exception, or simply
+                # return None.
+                self.check_permissions(clone_request(self.request, 'POST'))
+            else:
+                raise
 
     def pre_save(self, obj):
         """
diff --git a/rest_framework/tests/test_generics.py b/rest_framework/tests/test_generics.py
index 1550880b..7a87d389 100644
--- a/rest_framework/tests/test_generics.py
+++ b/rest_framework/tests/test_generics.py
@@ -338,6 +338,17 @@ class TestInstanceView(TestCase):
         new_obj = SlugBasedModel.objects.get(slug='test_slug')
         self.assertEqual(new_obj.text, 'foobar')
 
+    def test_patch_cannot_create_an_object(self):
+        """
+        PATCH requests should not be able to create objects.
+        """
+        data = {'text': 'foobar'}
+        request = factory.patch('/999', data, format='json')
+        with self.assertNumQueries(1):
+            response = self.view(request, pk=999).render()
+        self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
+        self.assertFalse(self.objects.filter(id=999).exists())
+
 
 class TestOverriddenGetObject(TestCase):
     """
-- 
cgit v1.2.3


From e7927e9bca5bc0d0ac3b528e68244c713c5df97f Mon Sep 17 00:00:00 2001
From: Tom Christie
Date: Fri, 23 Aug 2013 13:35:50 +0100
Subject: Extra docs on PATCH with no object.

---
 rest_framework/mixins.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/rest_framework/mixins.py b/rest_framework/mixins.py
index 59d64469..426865ff 100644
--- a/rest_framework/mixins.py
+++ b/rest_framework/mixins.py
@@ -149,6 +149,8 @@ class UpdateModelMixin(object):
                 # return None.
                 self.check_permissions(clone_request(self.request, 'POST'))
             else:
+                # PATCH requests where the object does not exist should still
+                # return a 404 response.
                 raise
 
     def pre_save(self, obj):
-- 
cgit v1.2.3


From 7bbe0f868f02e3da902c6e0d11bf5b10bc55f616 Mon Sep 17 00:00:00 2001
From: Tom Christie
Date: Fri, 23 Aug 2013 13:37:25 +0100
Subject: Added @krzysiekj

For work on #1034.  Thanks!---
 docs/topics/credits.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/topics/credits.md b/docs/topics/credits.md
index 16ea78c4..e6d09bc2 100644
--- a/docs/topics/credits.md
+++ b/docs/topics/credits.md
@@ -160,6 +160,7 @@ The following people have helped make REST framework great.
 * Christopher Paolini - [chrispaolini]
 * Filipe A Ximenes - [filipeximenes]
 * Ramiro Morales - [ramiro]
+* Krzysztof Jurewicz - [krzysiekj]
 
 Many thanks to everyone who's contributed to the project.
 
@@ -356,3 +357,4 @@ You can also contact [@_tomchristie][twitter] directly on twitter.
 [chrispaolini]: https://github.com/chrispaolini
 [filipeximenes]: https://github.com/filipeximenes
 [ramiro]: https://github.com/ramiro
+[krzysiekj]: https://github.com/krzysiekj
-- 
cgit v1.2.3