2 Commits

Author	SHA1	Message	Date
Alexey Bezhan	36f41c23e1	Always use both folder and service ID when getting template folder ... Currently there aren't any permission checks based on folder IDs in the admin app or the API, so it's possible for a user to modify the folder ID to perform operations on folders outside their service. Our usual way to avoid this is to always use service_id filter when fetching objects from the database.	2018-11-07 13:51:37 +00:00
Leo Hemsted	fbe34041d6	add template folder CRUD ... * create template folder * rename template folder * get list of template folders for service (not nested/presented in any particular way) * delete template folder Also removed `lazy=dynamic` from the `template_folder.templates` relationship. lazy=dynamic returns a query object (which you can then filter further). We just want to return the entire fetched list, at least for now.	2018-10-31 14:28:16 +00:00