Fix: prevent note deletion outside doc

This commit is contained in:
shamoon
2026-01-29 13:29:30 -08:00
parent 6913f9d79c
commit e4b861d76f

View File

@@ -1099,7 +1099,7 @@ class DocumentViewSet(
):
return HttpResponseForbidden("Insufficient permissions to delete notes")
note = Note.objects.get(id=int(request.GET.get("id")))
note = Note.objects.get(id=int(request.GET.get("id")), document=doc)
if settings.AUDIT_LOG_ENABLED:
LogEntry.objects.log_create(
instance=doc,