Commit 63f95bc5 authored by Mickaël Desfrênes's avatar Mickaël Desfrênes
Browse files

fix bad permission

parent c3c1974f

rpc/views.py

+2 −1
Original line number Diff line number Diff line
@@ -101,6 +101,7 @@ def _join_parts( 




def _get_user_from_request(request: HttpRequest) -> Union[User, None]:

    print(request.headers)

    if request.user.is_authenticated:

        return request.user

    if "X-Api-Key" in request.headers:
@@ -276,7 +277,7 @@ def force_download( 
            user = _get_user_from_request(request)

            if not user:

                return HttpResponse("Forbidden", status=403)

            _check_project_permission(user, file.project, "file.download")

            _check_project_permission(user, file.project, "file.download_source")

    except ServiceException:

        return HttpResponse("Forbidden", status=403)

    return FileResponse(open(file.local_path(), "rb"), filename=file.original_name)