Ensure PermissionRequiredMixin validation logic is always called

[UnknownPlatypus]

Description

Hey Adam!

A common gotcha when using PermissionRequiredMixin is to place it last in your subclass hierarchy for ex:

class MyView(View, PermissionRequiredMixin):
    permission_required = "polls.add_choice"

Doing so, it actually never checks the permissions because of the MRO. The dispatch method from the View class will be called and because it doesn't call the super method, PermissionRequiredMixin.dispatch is silently skipped.

This can very easily lead to security concerns.

Would it make sens to add a rule to django-upgrade swapping the base classes automatically if the PermissionRequiredMixin is not the first base class ? Or does such feature makes more sense as a linter rule via flake8/ruff ?

Ref: https://stackoverflow.com/questions/54959548/django-permissionrequiredmixin-permission-required-not-working

[adamchainz]

I think I’d again say this is good for a linter rule. A ruleset in Ruff would indeed be cool.