Django Rest Framework DjangoModelPermissions not working properly

Question

Why the DRF permission class DjangoModelPermissions allow every users to perform all requests like POST, PUT, DELETE even those user i didn't manually assign them the add, change, delete permissions from my django admin. they are allowed to be only view the objects but why the are getting all unsafe request POST, DELETE... ?

Views.py

class HotelViewSet(viewsets.ModelViewSet):
    queryset = Hotel.objects.all()
    serializer_class = HotelSerializer
    authentication_classes = [SessionAuthentication]
    permission_classes = [DjangoModelPermissions]

settings.py

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework.authentication.SessionAuthentication',
    ],
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.DjangoModelPermissions',
        ]
}

user_8757925 · Answer

The viewsets.ModelViewSet does not implement delete(), post(), etc. methods itself. If you want to use it, you have to implement them yourself.

Instead, you should use Django REST generics. Please refer to Django REST framework docs: https://www.django-rest-framework.org/api-guide/generic-views/

user_9841740 · Answer

I would suggest using DRF generic views where you can use specific views like ListAPIView/ RetrieveAPIView for GET requests, CreateAPIView for POST, UpdateAPIView for PUT, etc.

Django Rest Framework DjangoModelPermissions not working properly

2 Answers