Skip to content

Commit f27e08d

Browse files
fix: Order of any kind should not be deleted except by admin (#6573)
* Only Admin should be allowed to delete an order. * Remove redundant before_delete_object and raise proper exception. * Required changes. Co-authored-by: Areeb Jamal <[email protected]>
1 parent d19294b commit f27e08d

File tree

1 file changed

+1
-15
lines changed

1 file changed

+1
-15
lines changed

app/api/orders.py

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -431,27 +431,13 @@ def after_update_object(self, order, data, view_kwargs):
431431
send_notif_ticket_purchase_organizer(order.event.owner, order.invoice_number, order_url,
432432
order.event.name, order.identifier)
433433

434-
def before_delete_object(self, order, view_kwargs):
435-
"""
436-
method to check for proper permissions for deleting
437-
:param order:
438-
:param view_kwargs:
439-
:return:
440-
"""
441-
if not has_access('is_coorganizer', event_id=order.event.id):
442-
raise ForbiddenException({'source': ''}, 'Access Forbidden')
443-
elif order.amount and order.amount > 0 and (order.status == 'completed' or order.status == 'placed'):
444-
raise ConflictException({'source': ''}, 'You cannot delete a placed/completed paid order.')
445-
446434
# This is to ensure that the permissions manager runs and hence changes the kwarg from order identifier to id.
447-
decorators = (jwt_required, api.has_permission(
448-
'auth_required', methods="PATCH,DELETE", model=Order),)
435+
decorators = (jwt_required, api.has_permission('is_admin', methods="DELETE", model=Order),)
449436
schema = OrderSchema
450437
data_layer = {'session': db.session,
451438
'model': Order,
452439
'methods': {
453440
'before_update_object': before_update_object,
454-
'before_delete_object': before_delete_object,
455441
'before_get_object': before_get_object,
456442
'after_update_object': after_update_object
457443
}}

0 commit comments

Comments
 (0)