paradizelost/paperless-ngx
1
0
Fork 0
mirror of https://github.com/paperless-ngx/paperless-ngx.git synced 2025-08-12 00:19:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix: bulk edit objects does not respect global permissions (#5888)

Browse Source
This commit is contained in:
shamoon
2024-02-25 16:59:59 -08:00
committed by GitHub
parent 4948438378
commit db0a2eb1a3
5 changed files with 101 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/documents/views.py
View File

@@ -1419,7 +1419,15 @@ class BulkEditObjectsView(GenericAPIView, PassUserMixin):
objs = object_class.objects.filter(pk__in=object_ids)
if not user.is_superuser:
has_perms = all((obj.owner == user or obj.owner is None) for obj in objs)
model_name = object_class._meta.verbose_name
perm = (
f"documents.change_{model_name}"
if operation == "set_permissions"
else f"documents.delete_{model_name}"
)
has_perms = user.has_perm(perm) and all(
(obj.owner == user or obj.owner is None) for obj in objs
)
if not has_perms:
return HttpResponseForbidden("Insufficient permissions")