权限：在django rest框架中

Question

I m working on django rest framework. I m having problems on permissions. I want to give GET And POST permission to admin user and only POST permission to other users(authentic). So far i have written the following code:

pemisssions.py

class UserAccessPermission(permissions.BasePermission):
    def has_permission(self, request, view):
        if request.method == 'GET' or request.method == 'POST':
            return request.user and request.user.is_staff
        if request.method == 'POST':
            return request.user and request.user.is_authenticated()

This code is not working as expected. Only admin users are able to GET and POST. And others users are not getting any kind of permission.

Guys help. Thanks in advance.

EDITED

class UserAccessPermission(permissions.BasePermission):
    def has_permission(self, request, view):
        if request.method == 'POST':
            return request.user and request.user.is_authenticated()
        elif request.method == 'GET':
            return request.user and request.user.is_staff

Answer 1

There's a mistake in your conditions. If it's a GEt request, the first condition always matches, which requires admin permissions.

Here's what you want:

class UserAccessPermission(permissions.BasePermission):
    def has_permission(self, request, view):
    if request.method == 'POST':
            return request.user and request.user.is_authenticated()    
    elif request.method == 'GET': # no need to check for POST here
            return request.user and request.user.is_staff

Answer 2

您正在使用elif ，但不会评估此部分，因为如果方法是POST则第一个条件始终为True