Commit 14748652 authored by Mickaël Desfrênes's avatar Mickaël Desfrênes
Browse files

bypass download auth if debug

parent 384f13d7

rpc/views.py

+5 −4
Original line number Diff line number Diff line
@@ -268,13 +268,14 @@ def upload_partial(request: HttpRequest) -> HttpResponse: 
def force_download(

    request: HttpRequest, file_id: int

) -> Union[HttpResponse, FileResponse]:

    user = _get_user_from_request(request)

    if not user:

        return HttpResponse("Forbidden", status=403)

    file = models.File.objects.filter(id=file_id).first()

    if not file:

        return HttpResponse("Not Found", 404)

    try:

        if not settings.DEBUG:  # bypass auth in dev

            user = _get_user_from_request(request)

            if not user:

                return HttpResponse("Forbidden", status=403)

            _check_project_permission(user, file.project, "file.download")

    except ServiceException:

        return HttpResponse("Forbidden", status=403)