paradizelost/paperless-ngx
1
0
Fork 0
mirror of https://github.com/paperless-ngx/paperless-ngx.git synced 2025-08-12 00:19:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix: disable invalid create endpoints (#6320)

Browse Source
This commit is contained in:
shamoon
2024-04-07 11:50:40 -07:00
committed by GitHub
parent 622fcf96a0
commit 1d85caa8d0
3 changed files with 30 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/documents/views.py
View File

@@ -55,7 +55,6 @@ from rest_framework.exceptions import NotFound
from rest_framework.filters import OrderingFilter
from rest_framework.filters import SearchFilter
from rest_framework.generics import GenericAPIView
from rest_framework.mixins import CreateModelMixin
from rest_framework.mixins import DestroyModelMixin
from rest_framework.mixins import ListModelMixin
from rest_framework.mixins import RetrieveModelMixin
@@ -201,7 +200,7 @@ class IndexView(TemplateView):
return context
class PassUserMixin(CreateModelMixin):
class PassUserMixin(GenericAPIView):
"""
Pass a user object to serializer
"""
@@ -873,7 +872,7 @@ class SavedViewViewSet(ModelViewSet, PassUserMixin):
serializer.save(owner=self.request.user)
class BulkEditView(GenericAPIView, PassUserMixin):
class BulkEditView(PassUserMixin):
permission_classes = (IsAuthenticated,)
serializer_class = BulkEditSerializer
parser_classes = (parsers.JSONParser,)
@@ -1450,7 +1449,7 @@ def serve_file(doc: Document, use_archive: bool, disposition: str):
return response
class BulkEditObjectsView(GenericAPIView, PassUserMixin):
class BulkEditObjectsView(PassUserMixin):
permission_classes = (IsAuthenticated,)
serializer_class = BulkEditObjectsSerializer
parser_classes = (parsers.JSONParser,)
@@ -1582,7 +1581,7 @@ class CustomFieldViewSet(ModelViewSet):
queryset = CustomField.objects.all().order_by("-created")
class SystemStatusView(GenericAPIView, PassUserMixin):
class SystemStatusView(PassUserMixin):
permission_classes = (IsAuthenticated,)
def get(self, request, format=None):