using authorize function to specifically check for permission on setting the 'shareable' flag
@@ -863,9 +863,14 @@ def publish(request, shortkey, *args, **kwargs):
def set_resource_flag(request, shortkey, *args, **kwargs):
# only resource owners are allowed to change resource flags
ajax_response_data = {'status': 'error', 'message': ''}
- res, _, user = authorize(request, shortkey, needed_permission=ACTION_TO_AUTHORIZE.SET_RESOURCE_FLAG)
flag = resolve_request(request).get('flag', None)
+ if flag in ('make_shareable', 'make_not_shareable'):
+ res, _, user = authorize(request, shortkey, needed_permission=ACTION_TO_AUTHORIZE.SET_RESOURCE_FLAG,
+ check_shareable=True)
+ else:
+ res, _, user = authorize(request, shortkey, needed_permission=ACTION_TO_AUTHORIZE.SET_RESOURCE_FLAG)
message = None
+
if flag == 'make_public':
message = _set_resource_sharing_status(user, res, flag_to_set='public', flag_value=True)
elif flag == 'make_private' or flag == 'make_not_discoverable':
@@ -1729,7 +1734,7 @@ def _set_resource_sharing_status(user, resource, flag_to_set, flag_value):
if flag_to_set == 'shareable': # too simple to deserve a method in AbstractResource
# access control is separate from validation logic
- if not user.uaccess.can_change_resource_flags(resource):
+ if not user.uaccess.can_change_resource_flags(resource, check_shareable=True):
return "You don't have permission to change resource sharing status"
if resource.raccess.shareable != flag_value:
resource.raccess.shareable = flag_value
