External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-02-25 15:06:02 -03:30
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4320 from cchurch/api-config-check-permissions

Browse Source 
Add check_permissions method to ApiV1ConfigView.
This commit is contained in:
Chris Church
2016-12-07 13:47:39 -05:00
committed by GitHub
parent eb3606e9fc 2727bbcf52
commit 9a68f48e4d
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
awx/api/views.py
View File

@@ -227,6 +227,11 @@ class ApiV1ConfigView(APIView):
permission_classes = (IsAuthenticated,) permission_classes = (IsAuthenticated,)
view_name = _('Configuration') view_name = _('Configuration')
def check_permissions(self, request):
super(ApiV1ConfigView, self).check_permissions(request)
if not request.user.is_superuser and request.method.lower() not in {'options', 'head', 'get'}:
self.permission_denied(request) # Raises PermissionDenied exception.
def get(self, request, format=None): def get(self, request, format=None):
'''Return various sitewide configuration settings.''' '''Return various sitewide configuration settings.'''
@@ -272,8 +277,6 @@ class ApiV1ConfigView(APIView):
return Response(data) return Response(data)
def post(self, request): def post(self, request):
if not request.user.is_superuser:
return Response(None, status=status.HTTP_404_NOT_FOUND)
if not isinstance(request.data, dict): if not isinstance(request.data, dict):
return Response({"error": _("Invalid license data")}, status=status.HTTP_400_BAD_REQUEST) return Response({"error": _("Invalid license data")}, status=status.HTTP_400_BAD_REQUEST)
if "eula_accepted" not in request.data: if "eula_accepted" not in request.data:
@@ -312,9 +315,6 @@ class ApiV1ConfigView(APIView):
return Response({"error": _("Invalid license")}, status=status.HTTP_400_BAD_REQUEST) return Response({"error": _("Invalid license")}, status=status.HTTP_400_BAD_REQUEST)
def delete(self, request): def delete(self, request):
if not request.user.is_superuser:
return Response(None, status=status.HTTP_404_NOT_FOUND)
try: try:
settings.LICENSE = {} settings.LICENSE = {}
return Response(status=status.HTTP_204_NO_CONTENT) return Response(status=status.HTTP_204_NO_CONTENT)