Dars rejasi

So'rovni tekshirish zanjiri

Har bir HTTP so'rovining viewga yetib borish yo'li

Standart DRF ruxsatlari

IDOR zaifligi va undan himoyalanish

Foydalanuvchi birovning maqolasini o'zgartirmoqchi bo'lganda nima sodir bo'ladi?

src/apps/common/permissions.py

class IsOwnerOrStaff(BasePermission):
    owner_field = "author"

    def has_object_permission(self, request, view, obj):
        if request.method in SAFE_METHODS:
            return True  # O'qishga hammaga ruxsat

        user = request.user
        if not (user and user.is_authenticated):
            return False
        if user.is_staff:
            return True  # Adminga to'liq ruxsat

        owner = getattr(obj, self.owner_field, None)
        return owner == user

perform_create nima uchun kerak?

class PostViewSet(viewsets.ModelViewSet):
    queryset = Post.objects.all()
    lookup_field = "slug"
    permission_classes = (IsAuthenticatedOrReadOnly, IsOwnerOrStaff)

    def perform_create(self, serializer):
        # Muallifni frontenddan EMAS, tokendan olamiz!
        serializer.save(author=self.request.user)

Atamalarni eslab qolamiz

Tezkor bilim tekshiruvi

Dasturchilar ko'p yo'l qo'yadigan xatolar

Amaliy topshiriq 15 daqiqa