rattail/tailbone
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Don't auto-include "Guest" role when finding roles w/ permission X

Browse source 
otherwise "all" roles are returned when checking for a perm which Guest role
does have granted
This commit is contained in:
Lance Edgar 2020-05-14 22:07:34 -05:00
parent 5f2dd31485
commit 2ac2a98727
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
tailbone/views/roles.py
View file

@ -271,7 +271,7 @@ class RolesView(PrincipalMasterView):
.options(orm.joinedload(model.Role._permissions)) .options(orm.joinedload(model.Role._permissions))
roles = [] roles = []
for role in all_roles: for role in all_roles:
if has_permission(session, role, permission): if has_permission(session, role, permission, include_guest=False):
roles.append(role) roles.append(role)
return roles return roles