List request - Githubissues

joestump / django-ajax

A simple framework for creating AJAX endpoints in Django.

http://github.com/joestump/django-ajax

BSD 3-Clause "New" or "Revised" License

260 stars 54 forks source link

List request #56

Closed justinabrahms closed 10 years ago

justinabrahms commented 10 years ago

This does a few things:

Do not provide a default of "show every model". Its 2 lines of code to change and not worth the security headache.
Changes the API of get_queryset to take a request instead of an object. This is necessary to support things that span beyond user-based permissions. In Sprint.ly's case, user+product is the specific permission we want here, which isn't exposed without passing the full request, as it'll be in post data.

nicholasserra commented 10 years ago

Wondering if we could just pass request as an extra parameter to get_queryset and not break backwards compat?

justinabrahms commented 10 years ago

It's still a backwards incompatible change, because get_queryset didn't necessarily take kwargs before. I can update the API to take kwargs so it'll be a bit easier going forward.

nicholasserra commented 10 years ago

Well in that case, a change is a change, so i'm okay with it as is :+1: