0x2620/pandora
2
1
Fork 1
Code Issues 1.3k Pull requests Releases Wiki Activity

users can see private items if they own it. limit to max_level instead, a80af1 fixup

Browse source
This commit is contained in:
j 2023-01-04 14:41:39 +00:00
parent 99a135c7d3
commit 623bbd472c
1 changed files with 2 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
pandora/item/models.py
View file

@ -233,9 +233,8 @@ class Item(models.Model):
def editable(self, user): def editable(self, user):
if user.is_anonymous: if user.is_anonymous:
return False return False
level = user.profile.get_level() max_level = len(settings.CONFIG['rightsLevels'])
allowed_level = settings.CONFIG['capabilities']['canSeeItem'][level] if self.level > max_level:
if self.level > allowed_level:
return False return False
if user.profile.capability('canEditMetadata') or \ if user.profile.capability('canEditMetadata') or \
user.is_staff or \ user.is_staff or \