Limit detail permissions to list/retrieve/superproject
Do not allow any other action that's not list, retrieve or
superproject when the detail=True (accessing an object directly)
`/subprojects/` and `/translations/` are considered `list` actions
with detail=True views.
@@ -22,7 +22,9 @@ class PublicDetailPrivateListing(IsAuthenticated):
# hitting ``/projects/``, allowing
return True
- if view.detail:
+ # detail view is only allowed on list/retrieve actions (not
+ # ``update`` or ``partial_update``)
+ if view.detail and view.action in ('list', 'retrieve', 'superproject'):
return True
project = view._get_parent_project()
