mirror of
https://gitlab2.federez.net/re2o/re2o
synced 2024-12-22 23:13:46 +00:00
Fix history acl
This commit is contained in:
parent
73a4d2fa27
commit
b4ca715695
1 changed files with 3 additions and 1 deletions
|
@ -536,6 +536,8 @@ def get_history_object(request, model, object_name, object_id):
|
|||
instance = None
|
||||
|
||||
if instance is None:
|
||||
# TODO : THIS IS A DECORATOR, YOU CANNOT USE IT LIKE THIS. AS IT, IT
|
||||
# WILL ALLOW ANYONE TO SEE THE HISTORY OF A DELETED OBJECT.
|
||||
authorized = can_view_app("logs")
|
||||
msg = None
|
||||
else:
|
||||
|
@ -581,7 +583,7 @@ def history(request, application, object_name, object_id):
|
|||
raise Http404(_("No model found."))
|
||||
|
||||
authorized, instance = get_history_object(request, model, object_name, object_id)
|
||||
if not can_view:
|
||||
if not authorized:
|
||||
return instance
|
||||
|
||||
history = get_history_class(model)
|
||||
|
|
Loading…
Reference in a new issue