github
/
jumpserver
mirror of https://github.com/jumpserver/jumpserver
1
0
Fork 0
Code Issues Releases Wiki Activity

perf: 修改关闭工单API权限, 申请人有权限关闭工单

pull/5469/head
Bai 2021-01-18 18:03:40 +08:00 committed by Jiangjie.Bai
parent 7b8f932dcd
commit a0cb16e5c4
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
apps/tickets/api/ticket.py
View File

@ -12,7 +12,7 @@ from common.permissions import IsValidUser, IsOrgAdmin
from tickets import serializers from tickets import serializers
from tickets.models import Ticket from tickets.models import Ticket
from tickets.permissions.ticket import IsAssignee, NotClosed from tickets.permissions.ticket import IsAssignee, IsAssigneeOrApplicant, NotClosed
__all__ = ['TicketViewSet'] __all__ = ['TicketViewSet']
@ -68,7 +68,7 @@ class TicketViewSet(CommonApiMixin, viewsets.ModelViewSet):
instance.reject(processor=request.user) instance.reject(processor=request.user)
return Response(serializer.data) return Response(serializer.data)
@action(detail=True, methods=[PUT], permission_classes=[IsOrgAdmin, IsAssignee, NotClosed]) @action(detail=True, methods=[PUT], permission_classes=[IsAssigneeOrApplicant, NotClosed])
def close(self, request, *args, **kwargs): def close(self, request, *args, **kwargs):
instance = self.get_object() instance = self.get_object()
serializer = self.get_serializer(instance) serializer = self.get_serializer(instance)

6
apps/tickets/permissions/ticket.py
View File

@ -7,6 +7,12 @@ class IsAssignee(permissions.BasePermission):
return obj.has_assignee(request.user) return obj.has_assignee(request.user)
class IsAssigneeOrApplicant(IsAssignee):
def has_object_permission(self, request, view, obj):
return super().has_object_permission(request, view, obj) or obj.applicant == request.user
class NotClosed(permissions.BasePermission): class NotClosed(permissions.BasePermission):
def has_object_permission(self, request, view, obj): def has_object_permission(self, request, view, obj):
return not obj.status_closed return not obj.status_closed