paradizelost/paperless-ngx
1
0
Fork 0
mirror of https://github.com/paperless-ngx/paperless-ngx.git synced 2025-07-30 18:27:45 -05:00
Code Issues Packages Projects Releases Wiki Activity

Add backend check for ws message ownership

Browse Source
This commit is contained in:
shamoon
2023-08-09 08:52:23 -07:00
parent 9291c98189
commit 3b666fef77
2 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/paperless/consumers.py
View File

@@ -10,6 +10,16 @@ class StatusConsumer(WebsocketConsumer):
def _authenticated(self):
return "user" in self.scope and self.scope["user"].is_authenticated
def _is_owner_or_unowned(self, data):
return (
(
self.scope["user"].is_superuser
or self.scope["user"].id == data["owner_id"]
)
if "owner_id" in data and "user" in self.scope
else True
)
def connect(self):
if not self._authenticated():
raise DenyConnection
@@ -30,4 +40,5 @@ class StatusConsumer(WebsocketConsumer):
if not self._authenticated():
self.close()
else:
self.send(json.dumps(event["data"]))
if self._is_owner_or_unowned(event["data"]):
self.send(json.dumps(event["data"]))