darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-05 06:01:46 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix and test archive service permissions

Browse Source 
Previously the backend would never validate permissions because the
"not service.active" part would (usually) fail. I've updated it to
match the (inverse of the) conditional we have in the HTML [1].

[1]: 6ac593aa5f/app/templates/views/service-settings.html (L455)
This commit is contained in:
Ben Thorner
2021-07-14 14:43:04 +01:00
parent cd95a891a7
commit 96a87e7cf2
2 changed files with 21 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/main/views/service_settings.py
View File

@@ -421,7 +421,7 @@ def service_confirm_broadcast_account_type(service_id, account_type):
@main.route("/services/<uuid:service_id>/service-settings/archive", methods=['GET', 'POST'])
@user_has_permissions('manage_service')
def archive_service(service_id):
if not current_service.active and (
if not current_service.active or not (
current_service.trial_mode or current_user.platform_admin
):
abort(403)