Merge branch 'dev' of https://github.com/hooram/ownphotos into add-se…

…parate-image-similarity-flask-server
hooram · Mar 27, 2019 · 2577a32 · 2577a32
2 parents 26a4b61 + 171ba50
commit 2577a32
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 3 deletions.
diff --git a/api/permissions.py b/api/permissions.py
@@ -1,5 +1,7 @@
 from rest_framework import permissions
 
+from constance import config as site_config
+
 
 class IsOwnerOrReadOnly(permissions.BasePermission):
     """
@@ -47,4 +49,13 @@ def has_object_permission(self, request, view, obj):
             if request.user in album.shared_to.all():
                 return True
 
-        return False
+        return False
+
+
+class IsRegistrationAllowed(permissions.BasePermission):
+    """
+    Custom permission to only allow if registration is allowed globally.
+    """
+
+    def has_permission(self, request, view):
+        return bool(site_config.ALLOW_REGISTRATION)
diff --git a/api/views.py b/api/views.py
@@ -55,7 +55,7 @@
 from api.serializers_serpy import PhotoSuperSimpleSerializer as PhotoSuperSimpleSerializerSerpy
 from api.serializers_serpy import PhotoSuperSimpleSerializerWithAddedOn as PhotoSuperSimpleSerializerWithAddedOnSerpy
 from api.serializers_serpy import SharedPhotoSuperSimpleSerializer as SharedPhotoSuperSimpleSerializerSerpy
-from api.permissions import IsOwnerOrReadOnly, IsUserOrReadOnly, IsPhotoOrAlbumSharedTo
+from api.permissions import IsOwnerOrReadOnly, IsUserOrReadOnly, IsPhotoOrAlbumSharedTo, IsRegistrationAllowed
 
 from api.face_classify import train_faces, cluster_faces
 from api.social_graph import build_social_graph, build_ego_graph
@@ -1225,7 +1225,11 @@ def get_queryset(self):
         return queryset
 
     def get_permissions(self):
-        if self.request.method == 'GET' or self.request.method == 'POST':
+        if self.action == 'create':
+            self.permission_classes = (IsRegistrationAllowed, )
+        elif self.action == 'list':
+            self.permission_classes = (IsAdminUser, )
+        elif self.request.method == 'GET' or self.request.method == 'POST':
             self.permission_classes = (AllowAny, )
         else:
             self.permission_classes = (IsUserOrReadOnly, )