Make sure credential can only be assigned to a user OR team, but never both. Fixes https://trello.com/c/yzlAEfAN

This commit is contained in:
Chris Church
2015-04-27 12:42:40 -04:00
parent 0f30ccc9b7
commit d1ea8708ad
4 changed files with 55 additions and 3 deletions

View File

@@ -1295,6 +1295,16 @@ class CredentialSerializer(BaseSerializer):
for field in Credential.PASSWORD_FIELDS:
if unicode(attrs.get(field, '')).startswith('$encrypted$'):
attrs.pop(field, None)
# If creating a credential from a view that automatically sets the
# parent_key (user or team), set the other value to None.
view = self.context.get('view', None)
parent_key = getattr(view, 'parent_key', None)
if parent_key == 'user':
attrs['team'] = None
if parent_key == 'team':
attrs['user'] = None
instance = super(CredentialSerializer, self).restore_object(attrs, instance)
return instance