haiwen/seahub
1
0
Fork 0
mirror of https://github.com/haiwen/seahub.git synced 2025-08-21 08:25:21 +00:00
Code Issues Releases Wiki Activity

[api2] Fix download repo perm

Browse Source
This commit is contained in:
zhengxie 2018-09-14 14:59:54 +08:00
parent 3cd878bd6a
commit 18fe766866
1 changed files with 9 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
seahub/api2/views.py
View File

@ -1404,10 +1404,16 @@ class DownloadRepo(APIView):
error_msg = 'Library %s not found.' % repo_id error_msg = 'Library %s not found.' % repo_id
return api_error(status.HTTP_404_NOT_FOUND, error_msg) return api_error(status.HTTP_404_NOT_FOUND, error_msg)
if not check_folder_permission(request, repo_id, '/'): perm = check_folder_permission(request, repo_id, '/')
if not perm:
return api_error(status.HTTP_403_FORBIDDEN, return api_error(status.HTTP_403_FORBIDDEN,
'You do not have permission to access this library.') 'You do not have permission to access this library.')
username = request.user.username
if not seafile_api.is_repo_syncable(repo_id, username, perm):
return api_error(status.HTTP_403_FORBIDDEN,
'unsyncable share permission')
return repo_download_info(request, repo_id) return repo_download_info(request, repo_id)
@ -4825,27 +4831,14 @@ class RepoTokensView(APIView):
if any([not _REPO_ID_PATTERN.match(repo_id) for repo_id in repos_id]): if any([not _REPO_ID_PATTERN.match(repo_id) for repo_id in repos_id]):
return api_error(status.HTTP_400_BAD_REQUEST, "Libraries ids are invalid") return api_error(status.HTTP_400_BAD_REQUEST, "Libraries ids are invalid")
username = request.user.username
tokens = {} tokens = {}
for repo_id in repos_id: for repo_id in repos_id:
repo = seafile_api.get_repo(repo_id) repo = seafile_api.get_repo(repo_id)
if not repo: if not repo:
continue continue
perm = check_folder_permission(request, repo.id, '/') if not check_folder_permission(request, repo.id, '/'):
if not perm: continue
res = {
'reason': 'no permission',
'unsyncable_path': '/'
}
return Response(res, status=status.HTTP_403_FORBIDDEN)
if not seafile_api.is_repo_syncable(repo_id, username, perm):
res = {
'reason': 'unsyncable share permission',
'unsyncable_path': '/'
}
return Response(res, status=status.HTTP_403_FORBIDDEN)
tokens[repo_id] = seafile_api.generate_repo_token(repo_id, request.user.username) tokens[repo_id] = seafile_api.generate_repo_token(repo_id, request.user.username)