Fix permissions evaluation for session-authenticated API requests

netbox/netbox/api.py

@@ -75,16 +75,15 @@ class TokenPermissions(DjangoObjectPermissions):
         super().__init__()
 
     def _verify_write_permission(self, request):
+
         # If token authentication is in use, verify that the token allows write operations (for unsafe methods).
-        if request.method in SAFE_METHODS:
-            return True
-        if isinstance(request.auth, Token) and request.auth.write_enabled:
+        if request.method in SAFE_METHODS or request.auth.write_enabled:
             return True
 
     def has_permission(self, request, view):
 
         # Enforce Token write ability
-        if not self._verify_write_permission(request):
+        if isinstance(request.auth, Token) and not self._verify_write_permission(request):
             return False
 
         return super().has_permission(request, view)
@@ -92,7 +91,7 @@ class TokenPermissions(DjangoObjectPermissions):
     def has_object_permission(self, request, view, obj):
 
         # Enforce Token write ability
-        if not self._verify_write_permission(request):
+        if isinstance(request.auth, Token) and not self._verify_write_permission(request):
             return False
 
         return super().has_object_permission(request, view, obj)