Skip to content
This repository has been archived by the owner on Mar 31, 2020. It is now read-only.

Commit

Permalink
Make CollectionView call query_for_user even if access checks are…
Browse files Browse the repository at this point in the history
… disabled
  • Loading branch information
gnudeb committed Jul 15, 2019
1 parent 54191d4 commit 225f8d6
Showing 1 changed file with 8 additions and 5 deletions.
13 changes: 8 additions & 5 deletions flask_crud/view.py
Expand Up @@ -25,7 +25,13 @@ def query(self) -> BaseQuery:
def query_for_user(self) -> BaseQuery:
model_cls = self._get_model()
if not hasattr(model_cls, 'query_for_user'):
raise NotImplementedError(f"{model_cls} does not implement query_for_user() and access control checks are enabled")
if self._access_checks_enabled():
raise NotImplementedError(
f"{model_cls} does not implement query_for_user()"
f" and access control checks are enabled"
)
else:
return self.query()

user = self._get_current_user()
# XXX: do we require user?
Expand Down Expand Up @@ -110,10 +116,7 @@ def get(self) -> BaseQuery:
if not self.list_enabled:
abort(405)

if self._access_checks_enabled():
query = self.query_for_user()
else:
query = self.query()
query = self.query_for_user()

query = self._add_prefetch(query)

Expand Down

0 comments on commit 225f8d6

Please sign in to comment.