Merge pull request #8964 from jumpserver/dev

v2.27.0-rc3

apps/assets/models/asset.py

@@ -118,7 +118,7 @@ class NodesRelationMixin:
             _nodes = node.get_ancestors(with_self=True)
             nodes.extend(list(_nodes))
         if flat:
-            nodes = list(reduce(lambda x, y: set(x) | set(y), nodes))
+            nodes = list(set([node.id for node in nodes]))
         return nodes
 
 

apps/rbac/permissions.py

@@ -121,8 +121,8 @@ class RBACPermission(permissions.DjangoModelPermissions):
         if request.user.is_anonymous and self.authenticated_users_only:
             return False
 
-        raw_action = getattr(view, 'raw_action', None)
-        if raw_action == 'metadata':
+        raw_action = getattr(view, 'raw_action', request.method)
+        if raw_action in ['metadata', 'OPTIONS']:
             return True
 
         perms = self.get_require_perms(request, view)