-
Notifications
You must be signed in to change notification settings - Fork 380
Open
Labels
Description
Bug Report
A owner can still access a deleted document, by accessing this deleted document, the request tree
will be triggered, and works (200 response) but the response will not be has expected because the actual deleted doc will not be part of the children of this tree anymore, creating a loop frontend side.
Possible solutions
-
Like the other, the owner get a 404 ?
docs/src/backend/core/api/permissions.py
Line 141 in 32e3c70
if obj.ancestors_deleted_at and not RoleChoices.OWNER in obj.user_roles: -
Or in the tree request, if it is the owner, we don't add a filter on the deleted documents:
docs/src/backend/core/api/viewsets.py
Line 881 in 32e3c70
children = self.queryset.filter(children_clause, deleted_at__isnull=True)
Metadata
Metadata
Assignees
Labels
Type
Projects
Status
No status