haiwen/seahub
1
0
Fork 0
mirror of https://github.com/haiwen/seahub.git synced 2025-08-11 20:01:40 +00:00
Code Issues Releases Wiki Activity

fix bug when get repo api token (#4652)

Browse Source 
Co-authored-by: lian <lian@seafile.com>
This commit is contained in:
lian 2020-08-18 17:33:31 +08:00 committed by GitHub
parent b2f6bb35de
commit 685ee2c21a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
seahub/api2/endpoints/repo_api_tokens.py
View File

@ -45,7 +45,7 @@ class RepoAPITokensView(APIView):
# permission check # permission check
username = request.user.username username = request.user.username
if not permission_check_admin_owner(username, repo_id, request): if not permission_check_admin_owner(request, username, repo_id):
error_msg = 'Permission denied.' error_msg = 'Permission denied.'
return api_error(status.HTTP_403_FORBIDDEN, error_msg) return api_error(status.HTTP_403_FORBIDDEN, error_msg)
@ -73,7 +73,7 @@ class RepoAPITokensView(APIView):
# permission check # permission check
username = request.user.username username = request.user.username
if not permission_check_admin_owner(username, repo_id, request): if not permission_check_admin_owner(request, username, repo_id):
error_msg = 'Permission denied.' error_msg = 'Permission denied.'
return api_error(status.HTTP_403_FORBIDDEN, error_msg) return api_error(status.HTTP_403_FORBIDDEN, error_msg)
@ -108,7 +108,7 @@ class RepoAPITokenView(APIView):
username = request.user.username username = request.user.username
# permission check # permission check
if not permission_check_admin_owner(username, repo_id, request): if not permission_check_admin_owner(request, username, repo_id):
error_msg = 'Permission denied.' error_msg = 'Permission denied.'
return api_error(status.HTTP_403_FORBIDDEN, error_msg) return api_error(status.HTTP_403_FORBIDDEN, error_msg)
@ -139,7 +139,7 @@ class RepoAPITokenView(APIView):
# permission check # permission check
username = request.user.username username = request.user.username
if not permission_check_admin_owner(username, repo_id, request): if not permission_check_admin_owner(request, username, repo_id):
error_msg = 'Permission denied.' error_msg = 'Permission denied.'
return api_error(status.HTTP_403_FORBIDDEN, error_msg) return api_error(status.HTTP_403_FORBIDDEN, error_msg)

7
seahub/repo_api_tokens/utils.py
View File

@ -12,14 +12,14 @@ from seahub.settings import ENABLE_VIDEO_THUMBNAIL, THUMBNAIL_ROOT
from seahub.thumbnail.utils import get_thumbnail_src from seahub.thumbnail.utils import get_thumbnail_src
from seahub.utils import is_pro_version, FILEEXT_TYPE_MAP, IMAGE, XMIND, VIDEO from seahub.utils import is_pro_version, FILEEXT_TYPE_MAP, IMAGE, XMIND, VIDEO
from seahub.utils.file_tags import get_files_tags_in_dir from seahub.utils.file_tags import get_files_tags_in_dir
from seahub.utils.repo import is_group_repo_staff from seahub.utils.repo import is_group_repo_staff, is_repo_owner
logger = logging.getLogger(__name__) logger = logging.getLogger(__name__)
json_content_type = 'application/json; charset=utf-8' json_content_type = 'application/json; charset=utf-8'
HTTP_520_OPERATION_FAILED = 520 HTTP_520_OPERATION_FAILED = 520
def permission_check_admin_owner(username, repo_id, request=None): # maybe add more complex logic in the future def permission_check_admin_owner(request, username, repo_id): # maybe add more complex logic in the future
""" """
if repo is owned by user return true if repo is owned by user return true
or check whether repo is owned by group and whether user is group's staff or check whether repo is owned by group and whether user is group's staff
@ -28,7 +28,8 @@ def permission_check_admin_owner(username, repo_id, request=None): # maybe add
else else
check user is the such group's staff check user is the such group's staff
""" """
if username == seafile_api.get_repo_owner(repo_id):
if is_repo_owner(request, repo_id, username):
return True return True
else: else:
return is_group_repo_staff(request, repo_id, username) return is_group_repo_staff(request, repo_id, username)