inventree/InvenTree
2
0
Fork 0
mirror of https://github.com/inventree/InvenTree.git synced 2025-06-18 13:05:42 +00:00
Code Activity

Fix permissions for global settings API

Browse Source
This commit is contained in:
Oliver Walters
2022-05-09 21:43:12 +10:00
parent cfaef06b9c
commit 30d799dbc6
2 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
InvenTree/common/api.py
View File

@ -146,7 +146,12 @@ class GlobalSettingsPermissions(permissions.BasePermission):
try:
user = request.user
return user.is_staff
if request.method in ['GET', 'HEAD', 'OPTIONS']:
return True
else:
# Any other methods require staff access permissions
return user.is_staff
except AttributeError: # pragma: no cover
return False
@ -175,6 +180,7 @@ class GlobalSettingsDetail(generics.RetrieveUpdateAPIView):
return common.models.InvenTreeSetting.get_setting_object(key)
permission_classes = [
permissions.IsAuthenticated,
GlobalSettingsPermissions,
]