diff --git a/seahub/api2/endpoints/file_comment.py b/seahub/api2/endpoints/file_comment.py index da9950b6cb..d62c7045c2 100644 --- a/seahub/api2/endpoints/file_comment.py +++ b/seahub/api2/endpoints/file_comment.py @@ -16,6 +16,7 @@ from seahub.avatar.settings import AVATAR_DEFAULT_SIZE from seahub.base.models import FileComment from seahub.utils.repo import is_repo_owner from seahub.views import check_folder_permission +from seahub.constants import PERMISSION_READ_WRITE logger = logging.getLogger(__name__) @@ -87,8 +88,7 @@ class FileCommentView(APIView): return api_error(status.HTTP_404_NOT_FOUND, error_msg) # permission check - username = request.user.username - if username != file_comment.author and not is_repo_owner(request, repo_id, username): + if check_folder_permission(request, repo_id, '/') != PERMISSION_READ_WRITE: error_msg = 'Permission denied.' return api_error(status.HTTP_403_FORBIDDEN, error_msg)