diff --git a/djangoldp/permissions.py b/djangoldp/permissions.py index e29c0a3eca259e3c86a49f4e2973c3d27a4f984c..5401b542cf6292259322977bff6974b38aeeb92d 100644 --- a/djangoldp/permissions.py +++ b/djangoldp/permissions.py @@ -149,7 +149,11 @@ class OwnerPermissions(LDPBasePermission): if request.user.is_superuser: return True if getattr(view.model._meta, 'owner_field', None): - return request.user == getattr(obj, view.model._meta.owner_field) + field = view.model._meta.get_field(view.model._meta.owner_field) + if field.many_to_many or field.one_to_many: + return request.user in getattr(obj, field.get_accessor_name()).all() + else: + return request.user == getattr(obj, view.model._meta.owner_field) if getattr(view.model._meta, 'owner_urlid_field', None) is not None: return request.user.urlid == getattr(obj, view.model._meta.owner_urlid_field) return True diff --git a/docs/create_model.md b/docs/create_model.md index 9db8ef7de262eb3a9783c2730cac7434b78bf2b0..9086ad15efd008cfa4bd594cb17d7e1c85580585 100644 --- a/docs/create_model.md +++ b/docs/create_model.md @@ -328,7 +328,7 @@ DjangoLDP comes with a set of permission classes that you can use for standard b * AnonymousReadOnly: Refuse access to anonymous users with any write request * LDDPermissions: Give access based on the permissions in the database. For container requests (list and create), based on model level permissions. For all others, based on object level permissions. This permission class is associated with a filter that only renders objects on which the user has access. * PublicPermission: Give access based on a public flag on the object. This class must be used in conjonction with the Meta option `public_field`. This permission class is associated with a filter that only render objects that have the public flag set. - * OwnerPermissions: Give access based on the owner of the object. This class must be used in conjonction with the Meta option `owner_field` or `owner_urlid_field`. This permission class is associated with a filter that only render objects of which the user is owner. + * OwnerPermissions: Give access based on the owner of the object. This class must be used in conjonction with the Meta option `owner_field` or `owner_urlid_field`. This permission class is associated with a filter that only render objects of which the user is owner. When using a reverse ForeignKey or M2M field with no related_name specified, do not add the '_set' suffix in the `owner_field`. * InheritPermissions: Give access based on the permissions on a related model. This class must be used in conjonction with the Meta option `inherit_permission`, which value must be a list of names of the `ForeignKey` or `OneToOneField` pointing to the objects bearing the permission classes. It also applies filter based on the related model. If several fields are given, at least one must give permission for the permission to be granted. Permission classes can be chained together in a list, or through the | and & operators. Chaining in a list is equivalent to using the & operator.