

from rest_framework  import permissions

class IsStaffOrTargetUser(permissions.BasePermission):
    def has_permission(self, request, view):
        return view.action == 'retrieve' or request.user.is_staff

    def has_object_permission(self, request, view, obj):
        return request.user.is_staff or obj == request.user


from rest_framework  import permissions

class IsStaffOrTargetUser(permissions.BasePermission):
    def has_permission(self, request, view):
        if view.action == 'retrieve':
            return True
        else:
            return hasattr(request, 'user') and request.user.is_staff

    def has_object_permission(self, request, view, obj):
        if hasattr(request, 'user'):
            return request.user.is_staff or obj == request.user
        return False


Fix IsStaffOrTargetUser permission when no user in request.
Fix IsStaffOrTargetUser permission when no user in request.

- 
- 
  from rest_framework  import permissions
  
  class IsStaffOrTargetUser(permissions.BasePermission):
      def has_permission(self, request, view):
-         return view.action == 'retrieve' or request.user.is_staff
+         if view.action == 'retrieve':
+             return True
+         else:
+             return hasattr(request, 'user') and request.user.is_staff
  
      def has_object_permission(self, request, view, obj):
+         if hasattr(request, 'user'):
-         return request.user.is_staff or obj == request.user
+             return request.user.is_staff or obj == request.user
+         return False
  
  
Fix IsStaffOrTargetUser permission when no user in request.
## Code Before:


from rest_framework  import permissions

class IsStaffOrTargetUser(permissions.BasePermission):
    def has_permission(self, request, view):
        return view.action == 'retrieve' or request.user.is_staff

    def has_object_permission(self, request, view, obj):
        return request.user.is_staff or obj == request.user


## Instruction:
Fix IsStaffOrTargetUser permission when no user in request.
## Code After:
from rest_framework  import permissions

class IsStaffOrTargetUser(permissions.BasePermission):
    def has_permission(self, request, view):
        if view.action == 'retrieve':
            return True
        else:
            return hasattr(request, 'user') and request.user.is_staff

    def has_object_permission(self, request, view, obj):
        if hasattr(request, 'user'):
            return request.user.is_staff or obj == request.user
        return False

