<commit_before>from rest_framework import permissions
from django.conf import settings


class IsAuthorOrReadOnly(permissions.BasePermission):
    """
    Object-level permission to only allow authors of an object to edit it.
    Assumes the model instance has an `author` attribute.

    This is the default class for the StoriesOfSolidarity API
    """

    def has_object_permission(self, request, view, obj):
        # Read permissions are allowed to any request,
        # so we'll always allow GET, HEAD or OPTIONS requests.
        if request.method in permissions.SAFE_METHODS:
            return True

        if obj.attr('author'):
            return obj.owner == request.user
        else:
            return False


class AllowAnonymousPostOrReadOnly(permissions.BasePermission):
    """
    Model-level permission to allow anyone to post a story anonymously,
    without an authentication token. However to avoid cross-site vulnerabilities
    we do require the request to be from a site in CORS_ORIGIN_WHITELIST.
    """
    def has_permission(self, request, view):
        if request.method in permissions.SAFE_METHODS:
            return True

        if request.method == "POST":
            # check request is coming from valid CORS domain
            # this can be spoofed, but we're just trying to stop spammers not 1337 haxxors
            if request.META.get('HTTP_ORIGIN') in settings.CORS_ORIGIN_WHITELIST:
                return True
            elif settings.DEBUG and request.META.get('REMOTE_ADDR') == '127.0.0.1':
                # debug server doesn't provide REMOTE_HOST headers, ensure localhost
                return True

        return False<commit_msg>debug error with cors headers on heroku<commit_after>from rest_framework import permissions
from django.conf import settings


class IsAuthorOrReadOnly(permissions.BasePermission):
    """
    Object-level permission to only allow authors of an object to edit it.
    Assumes the model instance has an `author` attribute.

    This is the default class for the StoriesOfSolidarity API
    """

    def has_object_permission(self, request, view, obj):
        # Read permissions are allowed to any request,
        # so we'll always allow GET, HEAD or OPTIONS requests.
        if request.method in permissions.SAFE_METHODS:
            return True

        if obj.attr('author'):
            return obj.owner == request.user
        else:
            return False


class AllowAnonymousPostOrReadOnly(permissions.BasePermission):
    """
    Model-level permission to allow anyone to post a story anonymously,
    without an authentication token. However to avoid cross-site vulnerabilities
    we do require the request to be from a site in CORS_ORIGIN_WHITELIST.
    """
    def has_permission(self, request, view):
        if request.method in permissions.SAFE_METHODS:
            return True

        if request.method == "POST":
            print "got POST from", request.META.get('HTTP_ORIGIN')
            # check request is coming from valid CORS domain
            # this can be spoofed, but we're just trying to stop spammers not 1337 haxxors
            if request.META.get('HTTP_ORIGIN') in settings.CORS_ORIGIN_WHITELIST:
                return True
            elif settings.DEBUG and request.META.get('REMOTE_ADDR') == '127.0.0.1':
                # debug server doesn't provide REMOTE_HOST headers, ensure localhost
                return True

        return False
{'fraction_non_alphanumeric': 0.06251800633823106, 'fraction_numerical': 0.005762028233938346, 'mean_word_length': 2.6016597510373445, 'pattern_counts': {'":': 2, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1732426', 'n_tokens_mistral': 931, 'n_tokens_neox': 871, 'n_words': 340}