Просмотр исходного кода

15582 check permissions on specific object when sync request (#15704)

* 15582 check permissions on specific object when sync request

* 15582 move permission check

* Enable translation of error message

---------

Co-authored-by: Jeremy Stretch <jstretch@netboxlabs.com>
Arthur Hanson 1 год назад
Родитель
Сommit
b8cedfcc08
1 измененных файлов с 5 добавлено и 4 удалено
  1. 5 4
      netbox/core/api/views.py

+ 5 - 4
netbox/core/api/views.py

@@ -1,5 +1,5 @@
 from django.shortcuts import get_object_or_404
-
+from django.utils.translation import gettext_lazy as _
 from rest_framework.decorators import action
 from rest_framework.exceptions import PermissionDenied
 from rest_framework.response import Response
@@ -33,10 +33,11 @@ class DataSourceViewSet(NetBoxModelViewSet):
         """
         Enqueue a job to synchronize the DataSource.
         """
-        if not request.user.has_perm('core.sync_datasource'):
-            raise PermissionDenied("Syncing data sources requires the core.sync_datasource permission.")
-
         datasource = get_object_or_404(DataSource, pk=pk)
+
+        if not request.user.has_perm('core.sync_datasource', obj=datasource):
+            raise PermissionDenied(_("This user does not have permission to synchronize this data source."))
+
         datasource.enqueue_sync_job(request)
         serializer = serializers.DataSourceSerializer(datasource, context={'request': request})