Skip to content

Commit

Permalink
Fix error when room owner edits room w/o admin privs
Browse files Browse the repository at this point in the history
  • Loading branch information
ThiefMaster committed Aug 19, 2022
1 parent ccdfdd8 commit 66ace43
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 0 deletions.
1 change: 1 addition & 0 deletions CHANGES.rst
Expand Up @@ -91,6 +91,7 @@ Bugfixes
- Fix misleading start and end times for Poster contributions in the timetable HTTP API
and the contributions placeholder in emails (:pr:`5443`)
- Do not mark persons as registered if the registration form has been deleted (:pr:`5448`)
- Fix error when a room owner who is not an admin edits their room (:pr:`5457`)

Internal Changes
^^^^^^^^^^^^^^^^
Expand Down
5 changes: 5 additions & 0 deletions indico/modules/rb/controllers/backend/admin.py
Expand Up @@ -67,6 +67,11 @@ def _process_PATCH(self, args):


class RHLocations(RHRoomBookingAdminBase):
def _skip_admin_check(self):
# GET on this endpoint does not expose anything sensitive, so
# we allow any room manager to use it if they can edit rooms
return request.method == 'GET' and rb_settings.get('managers_edit_rooms') and has_managed_rooms(session.user)

def _process_args(self):
id_ = request.view_args.get('location_id')
self.location = Location.get_or_404(id_, is_deleted=False) if id_ is not None else None
Expand Down

0 comments on commit 66ace43

Please sign in to comment.