components: fix parent update permissions

inveniosoftware · May 15, 2024 · ba09183 · ba09183
1 parent 2324d37
commit ba09183
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/invenio_communities/communities/services/components.py b/invenio_communities/communities/services/components.py
@@ -335,7 +335,11 @@ def create(self, identity, data=None, record=None, **kwargs):
 
     def update(self, identity, data=None, record=None, **kwargs):
         """Update parent community of a community."""
-        if "parent" in data:
+        if not data:
+            return
+        existing_parent_id = record.parent and str(record.parent.id)
+        new_parent_id = (data.get("parent") or {}).get("id")
+        if "parent" in data and new_parent_id != existing_parent_id:
             self.service.require_permission(identity, "manage_parent", record=record)
             parent = self._validate_and_get_parent(data["parent"], record)
             record.parent = parent