New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Should not be able to get visible submissions on invisible places via the API #19

Open

fkh opened this issue Jan 14, 2015 · 1 comment

Labels

bug

Member

fkh commented Jan 14, 2015

No description provided.

fkh added the bug label

Contributor

BenSturmfels commented Sep 8, 2021

I've just confirmed this issue by:

creating a place with a comment submission
confirming I can anonymously access the place via the API eg. /api/places/414720/
confirming I can anonymously access the comments via the API eg. /api/places/414720/comments
marking the place as 'visible = False`
confirming I cannot access the place via the API
confirming I can still access the comments via the API

Presumably this would apply to any of the URLs with ?P<place_id>\d+ in their URLs except for PlaceListView:

AttachmentListView
SubmissionInstanceView
SubmissionListView

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment