From 26d87967c5bdc252496a674ef4944e9a0d28e9a5 Mon Sep 17 00:00:00 2001 From: mdipierro Date: Sun, 28 Jun 2015 16:40:23 -0500 Subject: [PATCH] always allow access to appadmin/manage.auth if used is admin --- applications/welcome/controllers/appadmin.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/applications/welcome/controllers/appadmin.py b/applications/welcome/controllers/appadmin.py index 312a6554..4d208944 100644 --- a/applications/welcome/controllers/appadmin.py +++ b/applications/welcome/controllers/appadmin.py @@ -49,7 +49,8 @@ if request.function == 'manage': auth.table_group(), auth.table_permission()]) manager_role = manager_action.get('role', None) if manager_action else None - auth.requires_membership(manager_role)(lambda: None)() + if not (gluon.fileutils.check_credentials(request) or auth.has_membership(manager_role)): + raise HTTP(403, "Not authorized") menu = False elif (request.application == 'admin' and not session.authorized) or \ (request.application != 'admin' and not gluon.fileutils.check_credentials(request)):