Ensure owner of tracks/albums/artists can approve suggestions

This commit is contained in:
Eliot Berriot 2019-07-18 12:08:20 +02:00
parent 5b7fad0bef
commit 22bd1512c7
No known key found for this signature in database
GPG key ID: DD6965E2476E5C27
5 changed files with 86 additions and 7 deletions

View file

@ -11,7 +11,12 @@ def can_suggest(obj, actor):
def can_approve(obj, actor):
return obj.is_local and actor.user and actor.user.get_permissions()["library"]
if not obj.is_local or not actor.user:
return False
return (
actor.id is not None and actor.id == obj.attributed_to_id
) or actor.user.get_permissions()["library"]
class TagMutation(mutations.UpdateMutationSerializer):