diff --git a/changelog.d/20240828_053041_roman_rm_extra_checks.md b/changelog.d/20240828_053041_roman_rm_extra_checks.md new file mode 100644 index 00000000000..74337256b1f --- /dev/null +++ b/changelog.d/20240828_053041_roman_rm_extra_checks.md @@ -0,0 +1,5 @@ +### Changed + +- When cancelling a request, a user is no longer required to have + permissions to perform the original action + () diff --git a/cvat/apps/engine/permissions.py b/cvat/apps/engine/permissions.py index efa7d3f7b99..92d1b107b74 100644 --- a/cvat/apps/engine/permissions.py +++ b/cvat/apps/engine/permissions.py @@ -9,7 +9,7 @@ from django.shortcuts import get_object_or_404 from django.conf import settings -from rest_framework.exceptions import ValidationError, PermissionDenied, NotFound +from rest_framework.exceptions import ValidationError, PermissionDenied from rq.job import Job as RQJob from cvat.apps.engine.rq_job_handler import is_rq_job_owner @@ -1219,42 +1219,6 @@ def create(cls, request, view, obj: Optional[RQJob], iam_context: Dict): permissions = [] if view.basename == 'request': for scope in cls.get_scopes(request, view, obj): - if scope == cls.Scopes.CANCEL: - parsed_rq_id = obj.parsed_rq_id - - permission_class, resource_scope = { - ('import', 'project', 'dataset'): (ProjectPermission, ProjectPermission.Scopes.IMPORT_DATASET), - ('import', 'project', 'backup'): (ProjectPermission, ProjectPermission.Scopes.IMPORT_BACKUP), - ('import', 'task', 'annotations'): (TaskPermission, TaskPermission.Scopes.IMPORT_ANNOTATIONS), - ('import', 'task', 'backup'): (TaskPermission, TaskPermission.Scopes.IMPORT_BACKUP), - ('import', 'job', 'annotations'): (JobPermission, JobPermission.Scopes.IMPORT_ANNOTATIONS), - ('create', 'task', None): (TaskPermission, TaskPermission.Scopes.VIEW), - ('export', 'project', 'annotations'): (ProjectPermission, ProjectPermission.Scopes.EXPORT_ANNOTATIONS), - ('export', 'project', 'dataset'): (ProjectPermission, ProjectPermission.Scopes.EXPORT_DATASET), - ('export', 'project', 'backup'): (ProjectPermission, ProjectPermission.Scopes.EXPORT_BACKUP), - ('export', 'task', 'annotations'): (TaskPermission, TaskPermission.Scopes.EXPORT_ANNOTATIONS), - ('export', 'task', 'dataset'): (TaskPermission, TaskPermission.Scopes.EXPORT_DATASET), - ('export', 'task', 'backup'): (TaskPermission, TaskPermission.Scopes.EXPORT_BACKUP), - ('export', 'job', 'annotations'): (JobPermission, JobPermission.Scopes.EXPORT_ANNOTATIONS), - ('export', 'job', 'dataset'): (JobPermission, JobPermission.Scopes.EXPORT_DATASET), - }[(parsed_rq_id.action, parsed_rq_id.target, parsed_rq_id.subresource)] - - - resource = None - if (resource_id := parsed_rq_id.identifier) and isinstance(resource_id, int): - resource_model = { - 'project': Project, - 'task': Task, - 'job': Job, - }[parsed_rq_id.target] - - try: - resource = resource_model.objects.get(id=resource_id) - except resource_model.DoesNotExist as ex: - raise NotFound(f'The {parsed_rq_id.target!r} with specified id#{resource_id} does not exist') from ex - - permissions.append(permission_class.create_base_perm(request, view, scope=resource_scope, iam_context=iam_context, obj=resource)) - if scope != cls.Scopes.LIST: user_id = request.user.id if not is_rq_job_owner(obj, user_id):