PapaTutuWawa/etesync-server
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Collection: filter queryset only to collections for which the user has access to.

Browse Source
This commit is contained in:
Tom Hacohen 2020-02-26 21:13:33 +02:00
parent 771d2d013d
commit c74ed50bd5
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
django_etesync/views.py
View File

@ -50,7 +50,8 @@ class BaseViewSet(viewsets.ModelViewSet):
return serializer_class return serializer_class
def get_collection_queryset(self, queryset=Collection.objects): def get_collection_queryset(self, queryset=Collection.objects):
return queryset.all() user = self.request.user
return queryset.filter(members__user=user)
class CollectionViewSet(BaseViewSet): class CollectionViewSet(BaseViewSet):
@ -143,7 +144,7 @@ class CollectionItemViewSet(BaseViewSet):
@action_decorator(detail=True, methods=['GET']) @action_decorator(detail=True, methods=['GET'])
def revision(self, request, collection_uid=None, uid=None): def revision(self, request, collection_uid=None, uid=None):
col = get_object_or_404(Collection.objects, uid=collection_uid) col = get_object_or_404(self.get_collection_queryset(Collection.objects), uid=collection_uid)
col_it = get_object_or_404(col.items, uid=uid) col_it = get_object_or_404(col.items, uid=uid)
serializer = CollectionItemRevisionSerializer(col_it.revisions.order_by('-id'), many=True) serializer = CollectionItemRevisionSerializer(col_it.revisions.order_by('-id'), many=True)
@ -169,7 +170,8 @@ class CollectionItemChunkViewSet(viewsets.ViewSet):
lookup_field = 'uid' lookup_field = 'uid'
def get_collection_queryset(self, queryset=Collection.objects): def get_collection_queryset(self, queryset=Collection.objects):
return queryset.all() user = self.request.user
return queryset.filter(members__user=user)
def create(self, request, collection_uid=None, collection_item_uid=None): def create(self, request, collection_uid=None, collection_item_uid=None):
col = get_object_or_404(self.get_collection_queryset(), uid=collection_uid) col = get_object_or_404(self.get_collection_queryset(), uid=collection_uid)