From 59919c5767fb9aeb476e19c59496bd3bd49ccde4 Mon Sep 17 00:00:00 2001 From: eric-intuitem <71850047+eric-intuitem@users.noreply.github.com> Date: Thu, 6 Jun 2024 00:25:26 +0200 Subject: [PATCH] Update views.py --- backend/core/views.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/backend/core/views.py b/backend/core/views.py index 76d50d063..531fa6f11 100644 --- a/backend/core/views.py +++ b/backend/core/views.py @@ -65,10 +65,11 @@ def get_queryset(self): if not self.model: return None if q := re.match("/api/[\w-]+/([0-9a-f-]+)", self.request.path): - """"get_queryset is called by Django even for an individual object""" + """"get_queryset is called by Django even for an individual object via get_object + https://stackoverflow.com/questions/74048193/why-does-a-retrieve-request-end-up-calling-get-queryset""" id = UUID(q.group(1)) if RoleAssignment.is_object_readable(self.request.user, self.model, id): - return self.model.objects.filter(id=id) + object_ids_view = [id] else: # todo: exception to refuse access object_ids_view = []