yetangitu/funkwhale
1
0
Fork 0
mirror of https://code.eliotberriot.com/funkwhale/funkwhale.git synced 2025-10-04 10:29:20 +02:00
Code Issues Releases Wiki Activity

See #223: dangerous actions can now prevent executing an action on all objects

Browse source
This commit is contained in:
Eliot Berriot 2018-05-29 21:55:00 +02:00
parent 7df9112d55
commit 7b84a988fd
No known key found for this signature in database
GPG key ID: DD6965E2476E5C27
2 changed files with 43 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
api/funkwhale_api/common/serializers.py
View file

@ -12,6 +12,9 @@ class ActionSerializer(serializers.Serializer):
filters = serializers.DictField(required=False)
actions = None
filterset_class = None
# those are actions identifier where we don't want to allow the "all"
# selector because it's to dangerous. Like object deletion.
dangerous_actions = []
def __init__(self, *args, **kwargs):
self.queryset = kwargs.pop('queryset')
@ -49,6 +52,10 @@ class ActionSerializer(serializers.Serializer):
'list of identifiers or the string "all".'.format(value))
def validate(self, data):
dangerous = data['action'] in self.dangerous_actions
if dangerous and self.initial_data['objects'] == 'all':
raise serializers.ValidationError(
'This action is to dangerous to be applied to all objects')
if self.filterset_class and 'filters' in data:
qs_filterset = self.filterset_class(
data['filters'], queryset=data['objects'])