from rest_framework import permissions

class IsOwnerOrCreate(permissions.BasePermission):
    """
    Check whether the resource's owner is authenticated user
    or creating new resource which require no authentication info
    """
    def has_object_permission(self, request, view, obj):
        if request.method == 'POST':
            return True
        else:
            return obj.owner == request.user

@@ -1,8 +1,35 @@
+%22%22%22%0ACustom permissions%0A%22%22%22%0A
 from res
@@ -64,338 +64,882 @@
 ns%0A%0A
-class IsOwnerOrCreate(permissions.BasePermission):%0A    %22%22%22%0A    Check whether the resource's owner is authenticated user%0A    or creating new resource which require no authentication info%0A    %22%22%22%0A    def has_object_permission(self, request, view, obj):%0A        if request.method == 'POST':%0A            return True%0A        else:%0A    
+# Note that the %60has_object_permission%60 will not run when do%0A# %60create%60 (which is %60POST%60 method) action%0A%0A# These's no need to consider the unauthenticated request because%0A# they have been block by authentication scheme except those in%0A# AUTHENTICATION_EXCLUDE settings%0A%0Aclass IsOwner(permissions.BasePermission):%0A    %22%22%22%0A    Check whether the resource's owner is authenticated user%0A    or creating new resource which require no authentication info%0A    %22%22%22%0A    def has_object_permission(self, request, view, obj):%0A        return obj.owner == request.user%0A%0Aclass IsUser(permissions.BasePermission):%0A    %22%22%22%0A    This permission is used when a request want to retrieve or update%0A    a user's info.%0A    The authenticated user must be exactly the same with the user%0A    which the request want to do something with.%0A    %22%22%22%0A    def has_object_permission(self, request, view, obj):%0A
     
@@ -944,38 +944,32 @@
       return obj
-.owner
  == request.user

Add custom permission