diff --git a/program/views.py b/program/views.py index 2e187cf60596c157c034d3ad9e23122e87a43788..0b582ac59ea7b7d773df79df32a42b91291d8ff9 100644 --- a/program/views.py +++ b/program/views.py @@ -306,10 +306,10 @@ class APIImageViewSet(viewsets.ModelViewSet): pagination_class = LimitOffsetPagination def get_queryset(self): - """The queryset contains all the images if the requesting user is superuser, otherwise it - only includes the images owned by the requesting user.""" + """The queryset contains all the images if the method is safe, otherwise it only includes + the images owned by the requesting user.""" - if self.request.user.is_superuser: + if self.request.method in permissions.SAFE_METHODS: return Image.objects.all() else: return Image.objects.filter(owner=self.request.user.username)