webui: permission check for key management

4de937ac · Dányi Bence · 165539ab · 4de937ac
Commit 4de937ac authored Feb 20, 2013 by Dányi Bence
Hide whitespace changes
Inline Side-by-side

Showing with 1 additions and 2 deletions

one/views.py
+1 -2

No files found.
--- a/one/views.py
+++ b/one/views.py
@@ -457,8 +457,7 @@ def key_add(request):
 @require_POST
 def key_ajax_delete(request):
    try:
-        #TODO: permission check
-        key=get_object_or_404(SshKey, id=request.POST['id'])
+        key=get_object_or_404(SshKey, id=request.POST['id'], user=request.user)
        key.delete()
    except:
        messages.error(request, _('Failed to delete public key'))