Django rest_framework IsAdminUser not behaving
<p>I have a <code>viewset</code> in rest framework that is not behaving like I would expect. If I login with a non-staff user and navigate to the api-url/users I can see all the users listed there. </p>

<p>The <code>IsAuthenticated</code> permission is working, because if I logout I get an error saying that I am not authenticated. </p>

<p>Am I using these permissions wrong? I have done the tutorial and looked through the docs, but I can't find anything to tell me why this shouldn't work</p>

<p>views:</p>

<pre><code>class UserViewSet(viewsets.ModelViewSet):
    """Viewset for viewing users. Only to be used by admins"""
    queryset = LangaLangUserProfile.objects.all()
    serializer_class = UserSerializer
    filter_backends = (filters.DjangoFilterBackend, )
    filter_fields = '__all__'
    permissions_classes = (permissions.IsAdminUser, )

class LanguageViewSet(viewsets.ReadOnlyModelViewSet):
    """Viewset for Language objects, use the proper HTTP methods to modify them"""
    queryset = Language.objects.all()
    serializer_class = LanguageSerializer
    filter_backends = (filters.DjangoFilterBackend, )
    filter_fields = '__all__'
    permissions_classes = (permissions.IsAuthenticated, )
</code></pre>

<p>urls:</p>

<pre><code>router = routers.DefaultRouter()
router.register(r'users', views.UserViewSet)
router.register(r'language', views.LanguageViewSet)
</code></pre>

<p>serializers:</p>

<pre><code>class UserSerializer(serializers.ModelSerializer):
    """Serializer for User objects"""
    class Meta:
        model = LangaLangUserProfile
        fields = '__all__'

class LanguageSerializer(serializers.ModelSerializer):
    """Serializer for the Language model"""
    class Meta:
        model = Language
        fields = '__all__'
        depth = 2
</code></pre>

<p>Typo!</p>

<p>It's <a href="http://www.django-rest-framework.org/api-guide/permissions/" rel="nofollow"><code>permission_classes</code></a>, not <code>permissions_classes</code>.</p>

<hr>

<p>About this part:</p>

<blockquote>
  <p>The IsAuthenticated permission is working, because if I logout I cget an error saysing that I am not authenticated.</p>
</blockquote>

<p>I'm not sure why this is happening but I'd blame <code>DEFAULT_PERMISSION_CLASSES</code> in your Django settings - maybe you have <code>IsAuthenticated</code> specified there?</p>

python django django-rest-framework