darkhelm/notifications-api
1
0
Fork 0
mirror of https://github.com/GSA/notifications-api.git synced 2025-12-22 08:21:13 -05:00
Code Issues Packages Projects Releases Wiki Activity

reject approvals from people outside your service

Browse Source 
even if they're a platform admin
This commit is contained in:
Leo Hemsted
2020-07-16 12:07:55 +01:00
parent b8e6689f62
commit 4043e8fa5e
2 changed files with 30 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/broadcast_message/rest.py
View File

@@ -38,8 +38,13 @@ def _parse_nullable_datetime(dt):
def _update_broadcast_message(broadcast_message, new_status, updating_user):
if updating_user not in broadcast_message.service.users:
abort(
400,
f'User {updating_user.id} cannot approve broadcast {broadcast_message.id} from other service'
)
# TODO: Restrict status transitions
# TODO: validate that the user belongs to the same service, isn't the creator, has permissions, etc
if new_status == BroadcastStatusType.BROADCASTING:
# TODO: Remove this platform admin shortcut when the feature goes live
if updating_user == broadcast_message.created_by and not updating_user.platform_admin: