{"action":"created","issue":{"url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/1985","repository_url":"https://api.github.com/repos/tomchristie/django-rest-framework","labels_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/1985/labels{/name}","comments_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/1985/comments","events_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/1985/events","html_url":"https://github.com/tomchristie/django-rest-framework/issues/1985","id":46621626,"number":1985,"title":"Document how to handle permissions and filtering for related fields.","user":{"login":"tomchristie","id":647359,"avatar_url":"https://avatars.githubusercontent.com/u/647359?v=3","gravatar_id":"","url":"https://api.github.com/users/tomchristie","html_url":"https://github.com/tomchristie","followers_url":"https://api.github.com/users/tomchristie/followers","following_url":"https://api.github.com/users/tomchristie/following{/other_user}","gists_url":"https://api.github.com/users/tomchristie/gists{/gist_id}","starred_url":"https://api.github.com/users/tomchristie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tomchristie/subscriptions","organizations_url":"https://api.github.com/users/tomchristie/orgs","repos_url":"https://api.github.com/users/tomchristie/repos","events_url":"https://api.github.com/users/tomchristie/events{/privacy}","received_events_url":"https://api.github.com/users/tomchristie/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/tomchristie/django-rest-framework/labels/Documentation","name":"Documentation","color":"444444"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":15,"created_at":"2014-10-23T13:00:25Z","updated_at":"2016-04-30T20:57:37Z","closed_at":null,"body":"Currently relationships do not automatically apply the same set of permissions and filtering that are applied to views. If you need permissions or filter on relationships you need to deal with it explicitly.\r\n\r\nPersonally I don't see any good ways of dealing with this automatically, but it's obviously something that we could at least do with documenting better.\r\n\r\nRight now my opinion is that we should try to come up with a simple example case and document how you'd deal with that explicitly. Any automatic code for dealing with this should be left for third party package authors to handle. This allows other contributors to explore the problem and see if they can come up with any good solutions that could potentially be included in core.\r\n\r\nIn the future this issue might get promoted from 'Documentation' to 'Enhancement', but unless there's any concrete proposals that are backed up by a third part package then it'll stay in this state.\r\n"},"comment":{"url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/comments/215994994","html_url":"https://github.com/tomchristie/django-rest-framework/issues/1985#issuecomment-215994994","issue_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/1985","id":215994994,"user":{"login":"brk0v","id":47447,"avatar_url":"https://avatars.githubusercontent.com/u/47447?v=3","gravatar_id":"","url":"https://api.github.com/users/brk0v","html_url":"https://github.com/brk0v","followers_url":"https://api.github.com/users/brk0v/followers","following_url":"https://api.github.com/users/brk0v/following{/other_user}","gists_url":"https://api.github.com/users/brk0v/gists{/gist_id}","starred_url":"https://api.github.com/users/brk0v/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brk0v/subscriptions","organizations_url":"https://api.github.com/users/brk0v/orgs","repos_url":"https://api.github.com/users/brk0v/repos","events_url":"https://api.github.com/users/brk0v/events{/privacy}","received_events_url":"https://api.github.com/users/brk0v/received_events","type":"User","site_admin":false},"created_at":"2016-04-30T20:57:37Z","updated_at":"2016-04-30T20:57:37Z","body":"@fibbs  change nailgun's approach by adding following:\r\n\r\n```python\r\n            if isinstance(field, serializers.ManyRelatedField):\r\n                method_name = 'filter_%s' % name\r\n                try:\r\n                    func = getattr(self, method_name)\r\n                except AttributeError:\r\n                    pass\r\n                else:\r\n                    field.child_relation.queryset = func(field.child_relation.queryset) \r\n```"}}