

from rest_framework  import permissions

class IsStaffOrTargetUser(permissions.BasePermission):
    def has_permission(self, request, view):
        return view.action == 'retrieve' or request.user.is_staff

    def has_object_permission(self, request, view, obj):
        return request.user.is_staff or obj == request.user


from rest_framework  import permissions

class IsStaffOrTargetUser(permissions.BasePermission):
    def has_permission(self, request, view):
        if view.action == 'retrieve':
            return True
        else:
            return hasattr(request, 'user') and request.user.is_staff

    def has_object_permission(self, request, view, obj):
        if hasattr(request, 'user'):
            return request.user.is_staff or obj == request.user
        return False


Fix IsStaffOrTargetUser permission when no user in request.
Fix IsStaffOrTargetUser permission when no user in request.
