Flaschengeist
/
flaschengeist-schedule
7
0
Fork 0
Code Issues 2 Pull Requests Projects Releases Activity

fix(backend): Allow unassigning deleted users, but not assigning

This commit is contained in:
Ferdinand Thiessen 2021-12-05 22:59:13 +01:00
parent 32bcf7ecbf
commit 11a4f87005
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
backend/flaschengeist_events/routes.py
View File

@ -420,8 +420,10 @@ def assign_job(job_id, current_session: Session):
data = request.get_json() data = request.get_json()
job = event_controller.get_job(job_id) job = event_controller.get_job(job_id)
try: try:
user = userController.get_user(data["userid"])
value = data["value"] value = data["value"]
user = userController.get_user(
data["userid"], deleted=value < 0
) # allow unassigning deleted users, but not assigning
if (user == current_session.user_ and not user.has_permission(permissions.ASSIGN)) or ( if (user == current_session.user_ and not user.has_permission(permissions.ASSIGN)) or (
user != current_session.user_ and not current_session.user_.has_permission(permissions.ASSIGN_OTHER) user != current_session.user_ and not current_session.user_.has_permission(permissions.ASSIGN_OTHER)
): ):