github/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2025-12-10 16:51:24 +01:00
Code Issues Projects Releases Packages Wiki Activity

view-instance permission for debug URLs, closes #833

Browse source
This commit is contained in:
Simon Willison 2020-06-11 15:14:51 -07:00
commit 29c5ff493a
2 changed files with 36 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
datasette/views/special.py
View file

@ -14,6 +14,7 @@ class JsonDataView(BaseView):
self.needs_request = needs_request
async def get(self, request, as_format):
await self.check_permission(request, "view-instance")
if self.needs_request:
data = self.data_callback(request)
else:
@ -46,6 +47,7 @@ class PatternPortfolioView(BaseView):
self.ds = datasette
async def get(self, request):
await self.check_permission(request, "view-instance")
return await self.render(["patterns.html"], request=request)
@ -77,8 +79,8 @@ class PermissionsDebugView(BaseView):
self.ds = datasette
async def get(self, request):
if not await self.ds.permission_allowed(request.actor, "permissions-debug"):
return Response("Permission denied", status=403)
await self.check_permission(request, "view-instance")
await self.check_permission(request, "permissions-debug")
return await self.render(
["permissions_debug.html"],
request,
@ -93,9 +95,11 @@ class MessagesDebugView(BaseView):
self.ds = datasette
async def get(self, request):
await self.check_permission(request, "view-instance")
return await self.render(["messages_debug.html"], request)
async def post(self, request):
await self.check_permission(request, "view-instance")
post = await request.post_vars()
message = post.get("message", "")
message_type = post.get("message_type") or "INFO"