`permissions.DjangoModelPermissionsOrAnonReadOnly` doesn't actually enable anonymous read-only access in 3.15 about django-rest-framework

[tomchristie]

So... I think we should reassess and probably revert #8009, at least for a 3.15.1 release. (?)

Requiring "view" permissions is a decent idea, but it unavoidably changes an existing behaviour in a way that's going to break some existing installations.

Given that our permissions system was introduced before Django included the model "view" permission (I think?) it's not obvious that there's really a good way forward other than documenting what our built-in permissions do, and describing how to change them if needed. (Eg. how to require "view" permissions.)

Is this the most sensible course of action on this one?

[shammellee]

Confirmed. I thought I was going crazy.

[lpomfrey]

If we were ignoring existing installations, it kind of feels like the plain DjangoModelPermissions should handle the "view" permission.

Although that then raises the question of what DjangoModelPermissionsOrAnonReadOnly should do in the case of a logged in user that doesn't have the "view" permission, I'm not sure there's a common use case where you'd want an anonymous user to have more privileges than an authenticated one, but it could at first glance be expected to work either way.

So, yes, ignoring the "view" permission and documenting that is probably the most sensible route, at least in the short-term.