@@ -55,11 +55,16 @@ class EmptyListView(generics.ListCreateAPIView):
5555permission_classes = [permissions .DjangoModelPermissions ]
5656
5757
58+ class IgnoredGetQuerySetListView (GetQuerySetListView ):
59+ _ignore_model_permissions = True
60+
61+
5862root_view = RootView .as_view ()
5963api_root_view = DefaultRouter ().get_api_root_view ()
6064instance_view = InstanceView .as_view ()
6165get_queryset_list_view = GetQuerySetListView .as_view ()
6266empty_list_view = EmptyListView .as_view ()
67+ ignored_get_queryset_list_view = IgnoredGetQuerySetListView .as_view ()
6368
6469
6570def basic_auth_header (username ,password ):
@@ -107,6 +112,27 @@ def test_api_root_view_discard_default_django_model_permission(self):
107112response = api_root_view (request )
108113self .assertEqual (response .status_code ,status .HTTP_200_OK )
109114
115+ def test_ignore_model_permissions_with_unauthenticated_user (self ):
116+ """
117+ We check that the ``_ignore_model_permissions`` attribute
118+ doesn't ignore the authentication.
119+ """
120+ request = factory .get ('/' ,format = 'json' )
121+ request .resolver_match = ResolverMatch ('get' , (), {})
122+ response = ignored_get_queryset_list_view (request )
123+ self .assertEqual (response .status_code ,status .HTTP_401_UNAUTHORIZED )
124+
125+ def test_ignore_model_permissions_with_authenticated_user (self ):
126+ """
127+ We check that the ``_ignore_model_permissions`` attribute
128+ with an authenticated user.
129+ """
130+ request = factory .get ('/' ,format = 'json' ,
131+ HTTP_AUTHORIZATION = self .permitted_credentials )
132+ request .resolver_match = ResolverMatch ('get' , (), {})
133+ response = ignored_get_queryset_list_view (request )
134+ self .assertEqual (response .status_code ,status .HTTP_200_OK )
135+
110136def test_get_queryset_has_create_permissions (self ):
111137request = factory .post ('/' , {'text' :'foobar' },format = 'json' ,
112138HTTP_AUTHORIZATION = self .permitted_credentials )