diff --git a/beat/web/common/permissions.py b/beat/web/common/permissions.py index 05081b8e8558a11255e2575040a5f623c1ee17f0..6c15d5840dcaafd8b36971698c349357adb80376 100644 --- a/beat/web/common/permissions.py +++ b/beat/web/common/permissions.py @@ -27,21 +27,26 @@ from rest_framework import permissions + class IsSuperuser(permissions.BasePermission): """ Global permission check for super user """ + def has_permission(self, request, view): return request.user.is_superuser -class IsAuthor(permissions.BasePermission): +class IsAuthor(permissions.IsAuthenticated): """ Global permission check that verify if the user is also the onwer of the asked data """ def has_permission(self, request, view): - kwargs = request.parser_context.get('kwargs') - author_name = kwargs.get('author_name') - return request.user.username == author_name + allowed = super().has_permission(request, view) + if allowed: + kwargs = request.parser_context.get("kwargs") + author_name = kwargs.get("author_name") + allowed = request.user.username == author_name + return allowed