diff --git a/beat/web/code/api.py b/beat/web/code/api.py index 1a0fdd037e3280be4df23274d117e0c84ce9a2e8..7046ce6d46c355cdf8724079ad5c8836d07a69a4 100644 --- a/beat/web/code/api.py +++ b/beat/web/code/api.py @@ -58,7 +58,6 @@ class ShareCodeView(ShareView): class DiffView(generics.RetrieveAPIView): model = Code - permission_classes = [permissions.IsAuthenticated] serializer_class = DiffSerializer def get(self, request, author1, name1, version1, author2, name2, version2): @@ -79,13 +78,15 @@ class DiffView(generics.RetrieveAPIView): # Check that the user can access them - accessibility = object1.accessibility_for(request.user) - if not accessibility[1]: - return ForbiddenResponse(object1.fullname()) - - accessibility = object2.accessibility_for(request.user) - if not accessibility[1]: - return ForbiddenResponse(object2.fullname()) + has_access, open_source, _ = object1.accessibility_for(request.user) + if not ((request.user == object1.author) or \ + (has_access and open_source)): + return ForbiddenResponse("You cannot access the source-code of \"%s\"" % object1.fullname()) + + has_access, open_source, _ = object2.accessibility_for(request.user) + if not ((request.user == object2.author) or \ + (has_access and open_source)): + return ForbiddenResponse("You cannot access the source-code of \"%s\"" % object2.fullname()) # Compute the diff serializer = self.get_serializer({'object1': object1, diff --git a/beat/web/common/api.py b/beat/web/common/api.py index 8ae0a0f0f5af708cf0678a32bd55ade654872407..bc5cad89aa3a59e57af4bb78ab0dc458e88d39e1 100644 --- a/beat/web/common/api.py +++ b/beat/web/common/api.py @@ -178,7 +178,6 @@ class ListCreateContributionView(IsAuthorOrReadOnlyMixin, ListCreateBaseView): class DiffView(generics.RetrieveAPIView): model = Versionable - permission_classes = [permissions.IsAuthenticated] serializer_class = DiffSerializer def get(self, request, author1, name1, version1, author2, name2, version2):