This needs to be versioned. It's the correct thing to do though. Signed-off-by: Stephen Finucane <step...@that.guru> --- patchwork/api/person.py | 4 ++-- patchwork/api/user.py | 5 ++++- 2 files changed, 6 insertions(+), 3 deletions(-)
diff --git patchwork/api/person.py patchwork/api/person.py index c806c0dd..59d74a56 100644 --- patchwork/api/person.py +++ patchwork/api/person.py @@ -6,7 +6,7 @@ from rest_framework.serializers import HyperlinkedModelSerializer from rest_framework.generics import ListAPIView from rest_framework.generics import RetrieveAPIView -from rest_framework.permissions import IsAuthenticated +from rest_framework.permissions import IsAuthenticatedOrReadOnly from patchwork.api.embedded import UserSerializer from patchwork.models import Person @@ -27,7 +27,7 @@ class PersonSerializer(HyperlinkedModelSerializer): class PersonMixin(object): - permission_classes = (IsAuthenticated,) + permission_classes = (IsAuthenticatedOrReadOnly,) serializer_class = PersonSerializer def get_queryset(self): diff --git patchwork/api/user.py patchwork/api/user.py index 4ea2322e..d629a7aa 100644 --- patchwork/api/user.py +++ patchwork/api/user.py @@ -84,7 +84,10 @@ class UserDetailSerializer(UserListSerializer): class UserMixin(object): queryset = User.objects.all() - permission_classes = (permissions.IsAuthenticated, IsOwnerOrReadOnly) + permission_classes = ( + permissions.IsAuthenticatedOrReadOnly, + IsOwnerOrReadOnly, + ) class UserList(UserMixin, ListAPIView): -- 2.31.1 _______________________________________________ Patchwork mailing list Patchwork@lists.ozlabs.org https://lists.ozlabs.org/listinfo/patchwork