ORing object permissions falls back to has_permission if no object permission

sparkyb · sparkyb · commit 91f12360d0ca · 2021-05-07T10:00:31.000-04:00
Composing permissions with OR should fall back on has_permission when
has_object_permission isn't implemented. If has_object_permission is
not implemented, than its has_permission should apply to all objects.
Strictly speaking, BasePermission.has_object_permission could return
self.has_permission(request, view), but only in the OR case is it possible
that wasn't already true, so only doing that fallback in the OR case
saves some redundant calls to has_permission.
diff --git a/rest_framework/permissions.py b/rest_framework/permissions.py
@@ -81,9 +81,13 @@ def has_permission(self, request, view):
 
     def has_object_permission(self, request, view, obj):
         hasperm1 = self.op1.has_object_permission(request, view, obj)
+        if hasperm1 is NotImplemented:
+            hasperm1 = self.op1.has_permission(request, view)
         if hasperm1 and hasperm1 is not NotImplemented:
             return hasperm1
         hasperm2 = self.op2.has_object_permission(request, view, obj)
+        if hasperm2 is NotImplemented:
+            hasperm2 = self.op2.has_permission(request, view)
         return hasperm1 if hasperm2 is NotImplemented else hasperm2
 
 
