summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorÉtienne Loks <etienne.loks@iggdrasil.net>2022-05-09 13:01:46 +0200
committerÉtienne Loks <etienne.loks@iggdrasil.net>2022-12-12 12:21:00 +0100
commit5caf4058758d0e5640f1e92d919ffa3fcae0ba27 (patch)
treef380af0e7d422028d5e297df62dc490eeac802b9
parent0f5d1297503a97e865ce211b2a0c801b21cfd613 (diff)
downloadIshtar-5caf4058758d0e5640f1e92d919ffa3fcae0ba27.tar.bz2
Ishtar-5caf4058758d0e5640f1e92d919ffa3fcae0ba27.zip
Fix permission check
-rw-r--r--ishtar_common/utils.py7
1 files changed, 6 insertions, 1 deletions
diff --git a/ishtar_common/utils.py b/ishtar_common/utils.py
index 89700eaad..3202afede 100644
--- a/ishtar_common/utils.py
+++ b/ishtar_common/utils.py
@@ -46,6 +46,7 @@ from django import forms
from django.apps import apps
from django.conf import settings
from django.conf.urls import url
+from django.contrib.auth.models import Permission
from django.contrib.contenttypes.models import ContentType
from django.contrib.gis.geos import GEOSGeometry
from django.contrib.sessions.backends.db import SessionStore
@@ -243,7 +244,11 @@ def check_model_access_control(request, model, available_perms=None):
allowed = True
own = False
return allowed, own
- for perm, lbl in model._meta.permissions:
+ q = Permission.objects.filter(
+ content_type__app_label=model._meta.app_label,
+ content_type__model=model._meta.model_name
+ )
+ for perm in q.values_list("codename", flat=True):
if perm not in available_perms:
continue
if ishtaruser.person.has_right(perm, session=request.session):