From 8c01c2555acd273e638615f01098f58877e15a74 Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Mon, 24 Jun 2024 10:04:37 +0200 Subject: [PATCH] Restrict GET request to /audit-trail to SuperAdmins only --- modoboa/core/api/v2/viewsets.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modoboa/core/api/v2/viewsets.py b/modoboa/core/api/v2/viewsets.py index 2dd4dd17c..8061df4e4 100644 --- a/modoboa/core/api/v2/viewsets.py +++ b/modoboa/core/api/v2/viewsets.py @@ -12,6 +12,7 @@ from modoboa.admin.api.v1 import serializers as admin_v1_serializers from modoboa.core.api.v1 import serializers as core_v1_serializers from modoboa.core.api.v1 import viewsets as core_v1_viewsets from modoboa.lib import pagination +from modoboa.lib.permissions import IsSuperUser from modoboa.lib.throttle import GetThrottleViewsetMixin from ... import constants @@ -149,7 +150,7 @@ class LogViewSet(GetThrottleViewsetMixin, viewsets.ReadOnlyModelViewSet): pagination_class = pagination.CustomPageNumberPagination permission_classes = ( permissions.IsAuthenticated, - permissions.DjangoModelPermissions, + IsSuperUser, ) queryset = models.Log.objects.all() search_fields = ["logger", "level", "message"]