From 8157f9891f60ba86b13f41717e92e7f359ea0559 Mon Sep 17 00:00:00 2001
From: ibuler <ibuler@qq.com>
Date: Mon, 24 Jun 2024 14:50:53 +0800
Subject: [PATCH] =?UTF-8?q?perf:=20=E4=BC=98=E5=8C=96=E6=89=B9=E9=87=8F?=
 =?UTF-8?q?=E5=88=A0=E9=99=A4=E5=88=A4=E6=96=AD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 apps/common/api/permission.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/apps/common/api/permission.py b/apps/common/api/permission.py
index 19f63824f..c70597f15 100644
--- a/apps/common/api/permission.py
+++ b/apps/common/api/permission.py
@@ -1,6 +1,7 @@
 # -*- coding: utf-8 -*-
 #
 from django.contrib.auth import get_user_model
+from rest_framework.exceptions import ValidationError
 from rest_framework.request import Request
 
 from common.utils import lazyproperty
@@ -14,7 +15,13 @@ class AllowBulkDestroyMixin:
         我们规定，批量删除的情况必须用 `id` 指定要删除的数据。
         """
         query = str(filtered.query)
-        can = '`id` IN (' in query or '`id` =' in query or 'ptr_id` IN (' in query
+        can = (
+            '`id` IN (' in query or '`id` =' in query or
+            'ptr_id` IN (' in query or
+            '."id" IN' in query  # for postgresql
+        )
+        if not can:
+            raise ValidationError('Bulk destroy all is not allowed')
         return can