Closed
Description
openedon Jan 3, 2022
edit_string_translation api view currently does not explicitly specify permission class, which means that default settings for rest framework would be used.
When DjangoModelPermissionsOrAnonReadOnly is used as a default permission class:
REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': [
'rest_framework.authentication.SessionAuthentication',
],
# Use Django's standard `django.contrib.auth` permissions,
# or allow read-only access for unauthenticated users.
"DEFAULT_PERMISSION_CLASSES": [
"rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly"
],
}following error would be raised in ajax view to translate string:
Exception Type: AssertionError at /cms/localize/translate/1/strings/1/edit/
Exception Value: Cannot apply DjangoModelPermissionsOrAnonReadOnly on a view that does not set .queryset or have a .get_queryset() method.
I think that edit_string_translation view function should be decorated with required permission class to avoid taking defaults, ie:
@permission_classes([IsAuthenticated])Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Metadata
Assignees
Labels
No labels