Commit a42fdae2 authored by Joshua Johnston's avatar Joshua Johnston

Return a 403 if a view class's is_accessible returns false.

is_accessible says: Override this method to add permission checks.
This means that it should return forbidden since the item exists but you
are not allowed to see it
parent d2ed4477
...@@ -35,4 +35,4 @@ If you want to localize administrative interface, install `Flask-BabelEx <https: ...@@ -35,4 +35,4 @@ If you want to localize administrative interface, install `Flask-BabelEx <https:
Examples Examples
-------- --------
The library comes with a quite a few examples, you can find them in the `examples <https://github.com/mrjoes/flask-admin/tree/master/examples` directory. The library comes with a quite a few examples, you can find them in the `examples <https://github.com/mrjoes/flask-admin/tree/master/examples>` directory.
...@@ -297,7 +297,7 @@ class BaseView(with_metaclass(AdminViewMeta, BaseViewClass)): ...@@ -297,7 +297,7 @@ class BaseView(with_metaclass(AdminViewMeta, BaseViewClass)):
View function arguments View function arguments
""" """
if not self.is_accessible(): if not self.is_accessible():
return abort(404) return abort(403)
@property @property
def _debug(self): def _debug(self):
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment