Commit 49dd6f47 authored by Mickaël Desfrênes's avatar Mickaël Desfrênes
Browse files

fix add_collection

parent e7136f9e

src/rpc/methods.py

+4 −2
Original line number Diff line number Diff line
@@ -627,19 +627,21 @@ def add_collection(user: User, title: str, parent_id: int) -> Dict: 
    )

    if not parent:

        raise ServiceException(NO_SUCH_COLLECTION)

    acl = UserAccess(user, parent.project)

    collection_instance = Collection.objects.filter(

        title=title, parent=parent, project_id=parent.project.pk

    ).first()

    if not collection_instance:

        UserAccess(user, parent.project).check_update(parent)

        acl.check_update(parent)

        collection_instance, created = Collection.objects.get_or_create(

            title=title, parent=parent, project_id=parent.project.pk

        )

    # collection was previously soft-deleted, reactivate it.

    if collection_instance.deleted_at:

        UserAccess(user, parent.project).check_update(collection_instance)

        acl.check_update(parent)

        collection_instance.deleted_at = None

        collection_instance.save()

    # acl.check_read(collection_instance)  # possible security problem here, leaking data to unauthorized user

    return serializers.collection(collection_instance, cache=SerializerCache())