altf4arnold/datatracker
1
0
Fork 0
Code Issues Pull requests Actions 3 Packages Projects Releases Wiki Activity

Fix auth check for editing the metadata of a submission - the path

Browse source 
without an access token would not allow a Secretariat user but instead
always throw an exception
 - Legacy-Id: 7079
This commit is contained in:
Ole Laursen 2014-01-08 17:40:22 +00:00
parent 8dc19fd17e
commit 5e7d8c6c08
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
ietf/submit/views.py
View file

@ -130,10 +130,10 @@ def search_submission(request):
'name': name},
context_instance=RequestContext(request))
def can_edit_submission(request, submission, access_token):
def can_edit_submission(user, submission, access_token):
key_matched = access_token and submission.access_token() == access_token
if not key_matched: key_matched = submission.access_key == access_token # backwards-compat
return key_matched or has_role(request.user, "Secretariat")
return key_matched or has_role(user, "Secretariat")
def submission_status(request, submission_id, access_token=None):
submission = get_object_or_404(Submission, pk=submission_id)
@ -149,7 +149,7 @@ def submission_status(request, submission_id, access_token=None):
is_secretariat = has_role(request.user, "Secretariat")
is_chair = submission.group and submission.group.has_role(request.user, "chair")
can_edit = can_edit_submission(request, submission, access_token) and submission.state_id == "uploaded"
can_edit = can_edit_submission(request.user, submission, access_token) and submission.state_id == "uploaded"
can_cancel = (key_matched or is_secretariat) and submission.state.next_states.filter(slug="cancel")
can_group_approve = (is_secretariat or is_chair) and submission.state_id == "grp-appr"
can_force_post = is_secretariat and submission.state.next_states.filter(slug="posted")