fureunoir/schon
fureunoir/schon
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Features: 1) Add permission-aware get_queryset method to OrderProductViewSet; 2) Add permission-aware get_queryset method to PromoCodeViewSet;

Browse source 
Fixes: None;

Extra: None;
This commit is contained in:
Egor Pavlovich Gorbunov 2025-05-29 23:14:32 +03:00
parent 543594c2b8
commit 03c9874f63
1 changed files with 18 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
core/viewsets.py
View file

@ -377,6 +377,15 @@ class OrderProductViewSet(EvibesViewSet):
"list": OrderProductSimpleSerializer, "list": OrderProductSimpleSerializer,
} }
def get_queryset(self):
qs = super().get_queryset()
user = self.request.user
if user.has_perm("core.view_orderproduct"):
return qs
return qs.filter(user=user)
class ProductImageViewSet(EvibesViewSet): class ProductImageViewSet(EvibesViewSet):
queryset = ProductImage.objects.all() queryset = ProductImage.objects.all()
@ -397,6 +406,15 @@ class PromoCodeViewSet(EvibesViewSet):
"list": PromoCodeSimpleSerializer, "list": PromoCodeSimpleSerializer,
} }
def get_queryset(self):
qs = super().get_queryset()
user = self.request.user
if user.has_perm("core.view_promocode"):
return qs
return qs.filter(user=user)
class PromotionViewSet(EvibesViewSet): class PromotionViewSet(EvibesViewSet):
queryset = Promotion.objects.all() queryset = Promotion.objects.all()