Commit a62dc9a5 authored by Mickaël Desfrênes's avatar Mickaël Desfrênes
Browse files

add missing acess checks

parent 2fadf3e2

src/rpc/methods.py

+3 −1
Original line number Diff line number Diff line
@@ -391,7 +391,8 @@ def collections( 
    )

    if not parent:

        raise ServiceException(NO_SUCH_COLLECTION)

    UserAccess(user, parent.project).check_read(parent)

    acl = UserAccess(user, parent.project)

    acl.check_read(parent)

    limit_from, limit_to = _validate_limits(limit_from, limit_to)

    data = []

    if flat_list:
@@ -418,6 +419,7 @@ def collections( 
    query_set = query_set[limit_from:limit_to]

    serializer_cache = SerializerCache()

    for item in query_set:

        if acl.can_read(item):

            data.append(

                serializers.collection(

                    item,