decentral1se/pandora
1
0
Fork 0
forked from 0x2620/pandora
Code Issues Pull requests Projects Releases Wiki Activity

users can see private items if they own it. limit to max_level instead, a80af1 fixup

Browse source
This commit is contained in:
j 2023-01-04 14:41:39 +00:00
parent 99a135c7d3
commit 623bbd472c
1 changed files with 2 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
pandora/item/models.py
View file

@ -233,9 +233,8 @@ class Item(models.Model):
def editable(self, user):
if user.is_anonymous:
return False
level = user.profile.get_level()
allowed_level = settings.CONFIG['capabilities']['canSeeItem'][level]
if self.level > allowed_level:
max_level = len(settings.CONFIG['rightsLevels'])
if self.level > max_level:
return False
if user.profile.capability('canEditMetadata') or \
user.is_staff or \