From 11a4f8700595654f72e6d795b4a2b85e6f2f2980 Mon Sep 17 00:00:00 2001 From: Ferdinand Thiessen Date: Sun, 5 Dec 2021 22:59:13 +0100 Subject: [PATCH] fix(backend): Allow unassigning deleted users, but not assigning --- backend/flaschengeist_events/routes.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/backend/flaschengeist_events/routes.py b/backend/flaschengeist_events/routes.py index 06256ac..90a5432 100644 --- a/backend/flaschengeist_events/routes.py +++ b/backend/flaschengeist_events/routes.py @@ -420,8 +420,10 @@ def assign_job(job_id, current_session: Session): data = request.get_json() job = event_controller.get_job(job_id) try: - user = userController.get_user(data["userid"]) value = data["value"] + user = userController.get_user( + data["userid"], deleted=value < 0 + ) # allow unassigning deleted users, but not assigning if (user == current_session.user_ and not user.has_permission(permissions.ASSIGN)) or ( user != current_session.user_ and not current_session.user_.has_permission(permissions.ASSIGN_OTHER) ):