Skip to content
Snippets Groups Projects
Commit fe4a686f authored by Jonathan Weth's avatar Jonathan Weth :keyboard:
Browse files

Merge branch '284-documentation-is-created-before-permission-check' into 'master'

Resolve "Documentation is created before permission check"

Closes #284

See merge request !397
parents e63a6939 d82687aa
No related branches found
No related tags found
1 merge request!397Resolve "Documentation is created before permission check"
Pipeline #192240 canceled
......@@ -709,7 +709,10 @@ class Documentation(CalendarEvent):
*cls.parse_dummy(_id),
), True
return cls.objects.get(id=_id), False
obj = cls.objects.get(id=_id)
if not user.has_perm("alsijil.edit_documentation_rule", obj):
raise PermissionDenied()
return obj, False
def touch(self):
"""Ensure that participation statuses are created for this documentation."""
......
......@@ -110,9 +110,6 @@ class DocumentationBatchCreateOrUpdateMutation(graphene.Mutation):
# is only introduced in Django 5.0
obj, __ = Documentation.get_or_create_by_id(_id, info.context.user)
if not info.context.user.has_perm("alsijil.edit_documentation_rule", obj):
raise PermissionDenied()
if doc.topic is not None:
obj.topic = doc.topic
if doc.homework is not None:
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment