4 ms·
This is a good way to control what methods are allowed on the ViewSet, but still doesn't address the problem of fields being writable by default when the ViewSe
by alexbecker 10y ago
This is a good way to control what methods are allowed on the ViewSet, but still doesn't address the problem of fields being writable by default when the ViewSet allows writing.
- deleted 10y ago[deleted]
- chc 10y agoThis seems like the expected behavior. If allowing for writing didn't actually allow you to write anything, that would be pretty strange, wouldn't it? Or do I misunderstand?
- alexbecker 10y agoYou may want to expose some fields that you don't allow changing, such as what account owns the resource. When fields are writable by default, it is easy for someone to miss that they've made a field writable when they just meant to expose it for reading.
- Kpourdeilami 10y agoI think it's better to define field specific read/write permissions through the serializers. In the serializer's Meta class, you can define a readonly_fields tuple containing the string names of the read only fields
- qnrq 10y agoYou can also route only read-only methods in urls.py, for example via: url( r'path/$', TheModelViewSetView.as_view({"get": "list"}), name="thename" ) or "retrieve" instead of "list" for a route which includes PK. This of course makes the entire path read-only so it's not a way to make some fields writable and others not.
- rtpg 10y agoyeah, I think they're saying instead of having the Meta fields list create writable fields by default, it should be read-only by default, after which you could add a "writable_fields" list