From 69d169f5f629c1d02361198c4a76839a9f8d528d Mon Sep 17 00:00:00 2001
From: Tom Christie
Date: Fri, 8 Mar 2013 23:42:20 +0000
Subject: Neater override hooks and more docs for DjangoModelPermissions.

Refs #702.
---
 rest_framework/permissions.py | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

(limited to 'rest_framework/permissions.py')

diff --git a/rest_framework/permissions.py b/rest_framework/permissions.py
index 306f00ca..f18fb53e 100644
--- a/rest_framework/permissions.py
+++ b/rest_framework/permissions.py
@@ -102,6 +102,8 @@ class DjangoModelPermissions(BasePermission):
         'DELETE': ['%(app_label)s.delete_%(model_name)s'],
     }
 
+    authenticated_users_only = True
+
     def get_required_permissions(self, method, model_cls):
         """
         Given a model and an HTTP method, return the list of permission
@@ -115,13 +117,18 @@ class DjangoModelPermissions(BasePermission):
 
     def has_permission(self, request, view):
         model_cls = getattr(view, 'model', None)
-        if not model_cls:
-            return True
+        queryset = getattr(view, 'queryset', None)
+
+        if model_cls is None and queryset is not None:
+            model_cls = queryset.model
+
+        assert model_cls, ('Cannot apply DjangoModelPermissions on a view that'
+                           ' does not have `.model` or `.queryset` property.')
 
         perms = self.get_required_permissions(request.method, model_cls)
 
         if (request.user and
-            request.user.is_authenticated() and
+            (request.user.is_authenticated() or not self.authenticated_users_only) and
             request.user.has_perms(perms)):
             return True
         return False
-- 
cgit v1.2.3