dbkaplan / dry-rest-permissions

Rules based permissions for the Django Rest Framework
ISC License
376 stars 59 forks source link

filter_queryset looks only for view.lookup_field, ignoring view.lookup_url_kwarg #33

Open mlazze opened 7 years ago

mlazze commented 7 years ago

DRF GenericAPIView use lookup_url_kwarg as 'The URL keyword argument that should be used for object lookup. The URL conf should include a keyword argument corresponding to this value. If unset this defaults to using the same value as lookup_field.'

In fact, in GenericAPIView.get_object() we have

# Perform the lookup filtering.
lookup_url_kwarg = self.lookup_url_kwarg or self.lookup_field

assert lookup_url_kwarg in self.kwargs, (
            'Expected view %s to be called with a URL keyword argument '
            'named "%s". Fix your URL conf, or set the `.lookup_field` '
            'attribute on the view correctly.' %
            (self.__class__.__name__, lookup_url_kwarg)
        )

The problem is that in DRYPermissionFiltersBase.filter_queryset() we only check view.lookup_field:

# Check if this is a list type request
if view.lookup_field not in view.kwargs:
....

This causes filter_queryset to filter retrieve actions if lookup_url_kwarg != lookup_field and lookup_url_kwarg in view.kwargseven if it shouldn't.

Something along the lines of

# Check if this is a list type request
lookup_field = view.lookup_url_kwarg or view.lookup_field
if lookup_field not in view.kwargs:

I believe should fix it.

Am i missing something?