valitydev/redash
14
0
Fork 0
mirror of https://github.com/valitydev/redash.git synced 2024-11-07 01:25:16 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix #1383: dashboard co-editors shuould be able to edit widgets

Browse Source
This commit is contained in:
Arik Fraimovich 2016-11-15 15:53:06 +02:00
parent b70a24f6b4
commit 48a79fe996
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
redash/handlers/widgets.py
View File

@ -1,10 +1,11 @@
import json
from flask import request
from redash import models
from redash.permissions import require_permission, require_admin_or_owner, require_access, view_only
from redash.handlers.base import BaseResource
from redash.permissions import (require_access, require_admin_or_owner,
require_object_modify_permission,
require_permission, view_only)
class WidgetListResource(BaseResource):
@ -12,7 +13,7 @@ class WidgetListResource(BaseResource):
def post(self):
widget_properties = request.get_json(force=True)
dashboard = models.Dashboard.get_by_id_and_org(widget_properties.pop('dashboard_id'), self.current_org)
require_admin_or_owner(dashboard.user_id)
require_object_modify_permission(dashboard, self.current_user)
widget_properties['options'] = json.dumps(widget_properties['options'])
widget_properties.pop('id', None)
@ -55,7 +56,7 @@ class WidgetResource(BaseResource):
def post(self, widget_id):
# This method currently handles Text Box widgets only.
widget = models.Widget.get_by_id_and_org(widget_id, self.current_org)
require_admin_or_owner(widget.dashboard.user_id)
require_object_modify_permission(widget.dashboard, self.current_user)
widget_properties = request.get_json(force=True)
widget.text = widget_properties['text']
widget.save()
@ -65,7 +66,7 @@ class WidgetResource(BaseResource):
@require_permission('edit_dashboard')
def delete(self, widget_id):
widget = models.Widget.get_by_id_and_org(widget_id, self.current_org)
require_admin_or_owner(widget.dashboard.user_id)
require_object_modify_permission(widget.dashboard, self.current_user)
widget.delete_instance()
return {'layout': widget.dashboard.layout}