binarybeach/bb-plane-fork
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: workspace member invite to avoid lower permission user to invite higher permission member (#1309)

Browse source
This commit is contained in:
pablohashescobar 2023-06-16 19:52:24 +05:30 • committed by GitHub
parent 02111d779b
commit 4c0857233e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
7 changed files with 421 additions and 338 deletions
Download patch file Download diff file Expand all files Collapse all files

5
apiserver/plane/api/views/workspace.py
View file

@ -195,6 +195,11 @@ class InviteWorkspaceEndpoint(BaseAPIView):
{"error": "Emails are required"}, status=status.HTTP_400_BAD_REQUEST
)
# check for role level
requesting_user = WorkspaceMember.objects.get(workspace__slug=slug, member=request.user)
if len([email for email in emails if int(email.get("role", 10)) > requesting_user.role]):
return Response({"error": "You cannot invite a user with higher role"}, status=status.HTTP_400_BAD_REQUEST)
workspace = Workspace.objects.get(slug=slug)
# Check if user is already a member of workspace