github/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2025-12-10 16:51:24 +01:00
Code Issues Projects Releases Packages Wiki Activity

Extra permission rules for /-/create, closes #1937

Browse source
This commit is contained in:
Simon Willison 2022-12-14 12:21:18 -08:00
commit c094dde3ff
3 changed files with 64 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
datasette/views/database.py
View file

@ -613,6 +613,13 @@ class TableCreateView(BaseView):
ignore = data.get("ignore")
replace = data.get("replace")
if replace:
# Must have update-row permission
if not await self.ds.permission_allowed(
request.actor, "update-row", resource=database_name
):
return _error(["Permission denied - need update-row"], 403)
table_name = data.get("table")
if not table_name:
return _error(["Table is required"])
@ -630,6 +637,13 @@ class TableCreateView(BaseView):
if rows and row:
return _error(["Cannot specify both rows and row"])
if rows or row:
# Must have insert-row permission
if not await self.ds.permission_allowed(
request.actor, "insert-row", resource=database_name
):
return _error(["Permission denied - need insert-row"], 403)
if columns:
if rows or row:
return _error(["Cannot specify columns with rows or row"])