paradizelost/paperless-ngx
1
0
Fork 0
mirror of https://github.com/paperless-ngx/paperless-ngx.git synced 2025-08-12 00:19:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Note creation / deletion should respect doc permissions

Browse Source 
- Disable add note button on frontend
- Explicitly disable add / delete via api
This commit is contained in:
shamoon
2023-07-31 20:33:18 -07:00
parent ca4500692f
commit 2e67697d36
5 changed files with 82 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
src/documents/views.py
View File

@@ -502,19 +502,18 @@ class DocumentViewSet(
@action(methods=["get", "post", "delete"], detail=True)
def notes(self, request, pk=None):
currentUser = request.user
try:
doc = Document.objects.get(pk=pk)
if request.user is not None and not has_perms_owner_aware(
request.user,
if currentUser is not None and not has_perms_owner_aware(
currentUser,
"view_document",
doc,
):
return HttpResponseForbidden("Insufficient permissions")
return HttpResponseForbidden("Insufficient permissions to view")
except Document.DoesNotExist:
raise Http404
currentUser = request.user
if request.method == "GET":
try:
return Response(self.getNotes(doc))
@@ -525,6 +524,13 @@ class DocumentViewSet(
)
elif request.method == "POST":
try:
if currentUser is not None and not has_perms_owner_aware(
currentUser,
"change_document",
doc,
):
return HttpResponseForbidden("Insufficient permissions to create")
c = Note.objects.create(
document=doc,
note=request.data["note"],
@@ -545,6 +551,13 @@ class DocumentViewSet(
},
)
elif request.method == "DELETE":
if currentUser is not None and not has_perms_owner_aware(
currentUser,
"change_document",
doc,
):
return HttpResponseForbidden("Insufficient permissions to delete")
note = Note.objects.get(id=int(request.GET.get("id")))
note.delete()