toastdriven/django-tastypie — comment on commit 97b4d75b96fedd2bd6266961e9aabc6bddc2ddfd
File: tastypie/authorization.py line 71
By gingerlime:

shouldn't this default to False? (and GET checked/allowed explicitly if necessary)? I know it's unlikely that a new HTTP verb is introduced any time soon, but yet again, if the code was set to fail safe in the first place, it avoids security issues like we've seen with PATCH.