matthias/mayan-edms
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Don't allow adding index template nodes via the API until permission is properly implemented

Browse Source
This commit is contained in:
Roberto Rosario
2015-01-05 14:36:34 -04:00
parent 2f6d6768e1
commit 45475d9a65
1 changed files with 1 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
mayan/apps/document_indexing/api_views.py
View File

@@ -89,29 +89,16 @@ class APIIndexNodeInstanceDocumentListView(generics.ListAPIView):
return index_node_instance.documents.all()
class APIIndexTemplateListView(generics.ListCreateAPIView):
class APIIndexTemplateListView(generics.ListAPIView):
serializer_class = IndexTemplateNodeSerializer
filter_backends = (MayanObjectPermissionsFilter,)
mayan_object_permissions = {'GET': [PERMISSION_DOCUMENT_INDEXING_VIEW]}
def get_queryset(self):
index = get_object_or_404(Index, pk=self.kwargs['pk'])
try:
Permission.objects.check_permissions(self.request.user, [PERMISSION_DOCUMENT_INDEXING_EDIT])
except PermissionDenied:
AccessEntry.objects.check_access(PERMISSION_DOCUMENT_INDEXING_EDIT, self.request.user, index_node_instance.index)
return index.node_templates.all()
def get(self, *args, **kwargs):
"""Returns a list of all the template nodes for the selected index."""
return super(APIIndexTemplateListView, self).get(*args, **kwargs)
def post(self, *args, **kwargs):
"""Create a new template node for the selected new index."""
return super(APIIndexTemplateListView, self).post(*args, **kwargs)
class APIIndexTemplateView(generics.RetrieveUpdateDestroyAPIView):
serializer_class = IndexTemplateNodeSerializer