|
20 | 20 | get_file_download_token, get_search_repos, RELATED_REPOS_PREFIX, RELATED_REPOS_CACHE_TIMEOUT, SEARCH_REPOS_LIMIT, \
|
21 | 21 | format_repos
|
22 | 22 | from seahub.utils import is_org_context, normalize_cache_key
|
| 23 | +from seahub.views import check_folder_permission |
23 | 24 |
|
24 | 25 | from seaserv import seafile_api
|
25 | 26 |
|
@@ -104,6 +105,11 @@ def post(self, request):
|
104 | 105 | error_msg = 'Library %s not found.' % search_repo
|
105 | 106 | return api_error(status.HTTP_400_BAD_REQUEST, error_msg)
|
106 | 107 |
|
| 108 | + # permission check |
| 109 | + if not check_folder_permission(request, search_repo, '/'): |
| 110 | + error_msg = 'Permission denied.' |
| 111 | + return api_error(status.HTTP_403_FORBIDDEN, error_msg) |
| 112 | + |
107 | 113 | repos = [(repo.id, repo.origin_repo_id, repo.origin_path, repo.name)]
|
108 | 114 | is_all_repo = False
|
109 | 115 |
|
@@ -175,6 +181,11 @@ def post(self, request):
|
175 | 181 | error_msg = 'Library %s not found.' % repo_id
|
176 | 182 | return api_error(status.HTTP_400_BAD_REQUEST, error_msg)
|
177 | 183 |
|
| 184 | + # permission check |
| 185 | + if not check_folder_permission(request, repo_id, '/'): |
| 186 | + error_msg = 'Permission denied.' |
| 187 | + return api_error(status.HTTP_403_FORBIDDEN, error_msg) |
| 188 | + |
178 | 189 | repo = (repo.id, repo.origin_repo_id, repo.origin_path, repo.name)
|
179 | 190 |
|
180 | 191 | params = {
|
|
0 commit comments