From 73019f91fe55f2ac16ce179917f686bf1a931597 Mon Sep 17 00:00:00 2001 From: Tom Christie Date: Sat, 27 Apr 2013 14:29:32 +0200 Subject: Update docs on object-level permissions. Closes #801.--- docs/api-guide/permissions.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'docs/api-guide') diff --git a/docs/api-guide/permissions.md b/docs/api-guide/permissions.md index 4772c5e0..a7de77fc 100644 --- a/docs/api-guide/permissions.md +++ b/docs/api-guide/permissions.md @@ -21,7 +21,12 @@ If any permission check fails an `exceptions.PermissionDenied` exception will be REST framework permissions also support object-level permissioning. Object level permissions are used to determine if a user should be allowed to act on a particular object, which will typically be a model instance. -Object level permissions are run by REST framework's generic views when `.get_object()` is called. As with view level permissions, an `exceptions.PermissionDenied` exception will be raised if the user is not allowed to act on the given object. +Object level permissions are run by REST framework's generic views when `.get_object()` is called. +As with view level permissions, an `exceptions.PermissionDenied` exception will be raised if the user is not allowed to act on the given object. + +If you're writing your own views and want to enforce object level permissions, +you'll need to explicitly call the `.check_object_permissions(request, obj)` method on the view at the point at which you've retrieved the object. +This will either raise a `PermissionDenied` or `NotAuthenticated` exception, or simply return if the view has the appropraite permissions. ## Setting the permission policy -- cgit v1.2.3 From 33a26a76f1e8e1bde715711cca3acfd3992d07db Mon Sep 17 00:00:00 2001 From: Tom Christie Date: Sat, 27 Apr 2013 16:35:42 +0200 Subject: Typo --- docs/api-guide/permissions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'docs/api-guide') diff --git a/docs/api-guide/permissions.md b/docs/api-guide/permissions.md index a7de77fc..0c82b2a3 100644 --- a/docs/api-guide/permissions.md +++ b/docs/api-guide/permissions.md @@ -26,7 +26,7 @@ As with view level permissions, an `exceptions.PermissionDenied` exception will If you're writing your own views and want to enforce object level permissions, you'll need to explicitly call the `.check_object_permissions(request, obj)` method on the view at the point at which you've retrieved the object. -This will either raise a `PermissionDenied` or `NotAuthenticated` exception, or simply return if the view has the appropraite permissions. +This will either raise a `PermissionDenied` or `NotAuthenticated` exception, or simply return if the view has the appropriate permissions. ## Setting the permission policy -- cgit v1.2.3