External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-05-17 22:37:41 -02:30
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1785 from anoek/1689

Browse Source 
Filter out a users own Admin Role from their roles list
This commit is contained in:
Akita Noek
2016-05-03 14:40:33 -04:00
parent 7e445124a4 1f49b475bd
commit 1b0e3719f1
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
awx/api/views.py
View File

@@ -30,6 +30,8 @@ from django.views.decorators.csrf import csrf_exempt
from django.template.loader import render_to_string from django.template.loader import render_to_string
from django.core.servers.basehttp import FileWrapper from django.core.servers.basehttp import FileWrapper
from django.http import HttpResponse from django.http import HttpResponse
from django.contrib.contenttypes.models import ContentType
# Django REST Framework # Django REST Framework
from rest_framework.exceptions import PermissionDenied, ParseError from rest_framework.exceptions import PermissionDenied, ParseError
@@ -1100,7 +1102,9 @@ class UserRolesList(SubListCreateAttachDetachAPIView):
u = get_object_or_404(User, pk=self.kwargs['pk']) u = get_object_or_404(User, pk=self.kwargs['pk'])
if not self.request.user.can_access(User, 'read', u): if not self.request.user.can_access(User, 'read', u):
raise PermissionDenied() raise PermissionDenied()
return Role.filter_visible_roles(self.request.user, u.roles.all()) content_type = ContentType.objects.get_for_model(User)
return Role.filter_visible_roles(self.request.user, u.roles.all()) \
.exclude(content_type=content_type, object_id=u.id)
def post(self, request, *args, **kwargs): def post(self, request, *args, **kwargs):
# Forbid implicit role creation here # Forbid implicit role creation here