-
Notifications
You must be signed in to change notification settings - Fork 0
Closed
Description
When an entry is going to be stopped, we perform a check that help us to avoid users to stop entries that they don't own.
For example:
- User A do clock in, entry-id: 1234
- User B wants to clock out the entry: POST /time-entries/1234/stop
Since user B is not the owner of 1234
the app will return an error. This check is performed here
file:
time_tracker_api/time_entries/time_entries_model.py
code snippet
def check_whether_current_user_owns_item(self, data):
if (
data.owner_id is not None
and data.owner_id != self.current_user_id()
):
raise CustomError(
HTTPStatus.FORBIDDEN,
This has been working OK for a while but it seems an issue has been introduced around this code. Specifically, this section is not working as expected:
@staticmethod
def current_user_id():
return super().current_user_id()
It seems the constructor has been updated or so, the following error is being thrown here:
ERROR in api: super(): no arguments
Please review this issue and update the check, for now a dummy condition was introduced to replace the above-mentioned check.