Merge remote-tracking branch 'remotes/origin/master'

IMIO · Feb 3, 2025 · 8bdada5 · 8bdada5
2 parents cfd5333 + f601851
commit 8bdada5
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 3 deletions.
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -17,7 +17,7 @@ jobs:
           versions: 3.8.16
           command: pyenv -v
       - name: Cache eggs
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         env:
           cache-name: cache-eggs
         with:
@@ -43,7 +43,7 @@ jobs:
           versions: 3.8.16
           command: pyenv -v
       - name: Cache eggs
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         env:
           cache-name: cache-eggs
         with:

diff --git a/CHANGES.rst b/CHANGES.rst
@@ -11,8 +11,12 @@ Changelog
 1.16.0 (2024-12-19)
 -------------------
 
-- Overrided `ContactBaseBatchActionForm.available` method to handle anonymous search correctly.
+- Overrided `ContactBaseBatchActionForm.available` method to handle anonymous
+  search correctly.
   [sgeulette]
+- Check again `self.do_apply` in `BaseBatchActionForm.handleApply` to avoid
+  nasty behaviors.
+  [gbastien]
 
 1.15 (2024-04-10)
 -----------------

diff --git a/src/collective/eeafaceted/batchactions/browser/views.py b/src/collective/eeafaceted/batchactions/browser/views.py
@@ -135,6 +135,9 @@ def update(self):
     @button.buttonAndHandler(_(u'Apply'), name='apply', condition=lambda fi: fi.do_apply)
     def handleApply(self, action):
         """ """
+        if not self.do_apply:
+            raise Unauthorized
+
         data, errors = self.extractData()
         if errors:
             self.status = self.formErrorsMessage