[WEB-2604] chore: only admin can changed the project settings#5766
[WEB-2604] chore: only admin can changed the project settings#5766
Conversation
WalkthroughThe changes primarily modify the Changes
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
NarayanBavisetti
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (2)
apiserver/plane/app/views/project/base.py (2)
418-428: Improve permission check implementationThe new permission check aligns well with the PR objective. However, consider the following improvements:
- Replace the hard-coded role value (20) with a constant or enum for better maintainability.
- Make the error message more specific, mentioning that admin rights are required.
- Consider moving this permission check to a decorator for better reusability across other methods that might require the same check.
Here's a suggested refactor:
from plane.app.permissions import ROLE # At the class level @allow_permission([ROLE.ADMIN], level="PROJECT") def partial_update(self, request, slug, pk=None): try: workspace = Workspace.objects.get(slug=slug) # ... rest of the methodThis approach uses the existing
allow_permissiondecorator and assumes there's aROLE.ADMINconstant defined. If not, you should define it in the appropriate permissions file.
Line range hint
1-1000: Consider consistent permission checks across project-modifying methodsWhile the main changes focus on the
partial_updatemethod, it would be beneficial to review other methods in this file that modify project settings. Consider applying similar permission checks to ensure consistent access control across all project modification operations.To implement this consistently, you could:
- Create a custom permission class for admin-only project modifications.
- Apply this permission class to relevant methods using method decorators.
- Alternatively, implement a mixin that includes the permission check and can be easily added to multiple views.
This approach would enhance the overall security and consistency of your project management operations.
This reverts commit 39eabc2.
This reverts commit 39eabc2.
4 participants
chore:
Issue Link: WEB-2604
Summary by CodeRabbit
New Features
Bug Fixes