stash

core/tickets/api_v2.py

@@ -149,12 +149,12 @@ def filter_issues(issues, query):
 
 
 @api_view(['GET'])
-@permission_classes([])
-# @permission_classes([IsAuthenticated])
-# @permission_required('view_item', raise_exception=True)
+@permission_classes([IsAuthenticated])
 def search_issues(request, event_slug, query):
     try:
         event = Event.objects.get(slug=event_slug)
+        if not request.user.has_event_perm(event, 'view_issuethread'):
+            return Response(status=403)
         items = filter_issues(IssueThread.objects.filter(event=event), b64decode(query).decode('utf-8'))
         return Response(SearchResultSerializer(items, many=True).data)
     except Event.DoesNotExist:

core/tickets/migrations/0012_alter_itemrelation_item.py

@@ -0,0 +1,20 @@
+# Generated by Django 4.2.7 on 2024-11-20 01:48
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('inventory', '0007_remove_item_container_alter_item_event_itemplacement'),
+        ('tickets', '0011_train_old_spam'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='itemrelation',
+            name='item',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='issue_relations', to='inventory.item'),
+        ),
+    ]