mirror of
https://github.com/jumpserver/jumpserver.git
synced 2025-09-11 20:29:40 +00:00
fix: Allow superusers delete adhoc and playbook
This commit is contained in:
@@ -1,8 +1,8 @@
|
||||
# -*- coding: utf-8 -*-
|
||||
from django.db.models import Q
|
||||
from django.utils.translation import gettext_lazy as _
|
||||
|
||||
from common.api.generic import JMSBulkModelViewSet
|
||||
from common.permissions import IsOwnerOrAdminWritable
|
||||
from common.utils.http import is_true
|
||||
from rbac.permissions import RBACPermission
|
||||
from ..const import Scope
|
||||
@@ -17,7 +17,7 @@ __all__ = [
|
||||
class AdHocViewSet(JMSBulkModelViewSet):
|
||||
queryset = AdHoc.objects.all()
|
||||
serializer_class = AdHocSerializer
|
||||
permission_classes = (RBACPermission,)
|
||||
permission_classes = (RBACPermission, IsOwnerOrAdminWritable)
|
||||
search_fields = ('name', 'comment')
|
||||
filterset_fields = ['scope', 'creator']
|
||||
|
||||
@@ -26,13 +26,6 @@ class AdHocViewSet(JMSBulkModelViewSet):
|
||||
self.check_object_permissions(self.request, obj)
|
||||
return True
|
||||
|
||||
def check_object_permissions(self, request, obj):
|
||||
if request.method != 'GET' and obj.creator != request.user:
|
||||
self.permission_denied(
|
||||
request, message={"detail": _("Deleting other people's script is not allowed")}
|
||||
)
|
||||
return super().check_object_permissions(request, obj)
|
||||
|
||||
def get_queryset(self):
|
||||
queryset = super().get_queryset()
|
||||
user = self.request.user
|
||||
|
Reference in New Issue
Block a user