remote/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2026-09-28 12:54:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

Require view-instance permission for /-/allowed

Browse source 
Refs GHSA-hp2x-vx2r-6vxg

Co-authored-by: Alex Garcia <15178711+asg017@users.noreply.github.com>
This commit is contained in:
Simon Willison 2026-09-03 14:35:58 -07:00
commit 01bf476d51
2 changed files with 29 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
datasette/views/special.py
View file

@ -311,6 +311,7 @@ class AllowedResourcesView(BaseView):
has_json_alternate = False
async def get(self, request):
await self.ds.ensure_permission(action="view-instance", actor=request.actor)
await self.ds.refresh_schemas()
# Check if user has permissions-debug (to show sensitive fields)