diff --git a/djangoldp/views.py b/djangoldp/views.py index c6418ac87eaeea9b35ad6a6335f4a5d802248249..e4dc7a1155427f8fd8ea6bf07ee598521470e3f3 100644 --- a/djangoldp/views.py +++ b/djangoldp/views.py @@ -343,9 +343,19 @@ class LDPViewSet(LDPViewSetGenerator): return type(LDPSerializer)(self.model._meta.object_name.lower() + name_prefix + 'Serializer', (LDPSerializer,), {'Meta': meta_class}) + def is_safe_create(self, user, validated_data, *args, **kwargs): + ''' + A function which is checked before the create operation to confirm the validated data is safe to add + returns True by default + :return: True if the operation should be permitted, False to return a 403 response + ''' + return True + def create(self, request, *args, **kwargs): serializer = self.get_write_serializer(data=request.data) serializer.is_valid(raise_exception=True) + if not self.is_safe_create(request.user, serializer.validated_data): + return Response({'detail': 'You do not have permission to perform this action'}, status=status.HTTP_403_FORBIDDEN) self.perform_create(serializer) response_serializer = self.get_serializer()