old_contents: 
  
  from rest_framework  import permissions
  
  class IsStaffOrTargetUser(permissions.BasePermission):
      def has_permission(self, request, view):
          return view.action == 'retrieve' or request.user.is_staff
  
      def has_object_permission(self, request, view, obj):
          return request.user.is_staff or obj == request.user
  
  
new_contents: from rest_framework  import permissions
  
  class IsStaffOrTargetUser(permissions.BasePermission):
      def has_permission(self, request, view):
          if view.action == 'retrieve':
              return True
          else:
              return hasattr(request, 'user') and request.user.is_staff
  
      def has_object_permission(self, request, view, obj):
          if hasattr(request, 'user'):
              return request.user.is_staff or obj == request.user
          return False
  
  
subject: Fix IsStaffOrTargetUser permission when no user in request.