diff --git a/CHANGELOG.rst b/CHANGELOG.rst index df00c3fac0cf86203e80478ed1b43b9fc52dce1b..9c97c2075782ac84ce90b7b205b6a483dcd82dcf 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -14,6 +14,10 @@ Added * Allow apps to dynamically generate OAuth scopes +Fixed +~~~~~ +* The view for getting the progress of celery tasks didn't respect that there can be anonymous users. + Removed ~~~~~~~ diff --git a/aleksis/core/views.py b/aleksis/core/views.py index c2b113b67299626f44d90d88c29f23e025e7633f..e24bafa1705465173a8ae9d54669ae23d880ee04 100644 --- a/aleksis/core/views.py +++ b/aleksis/core/views.py @@ -1151,6 +1151,8 @@ class CeleryProgressView(View): """Wrap celery-progress view to check permissions before.""" def get(self, request: HttpRequest, task_id: str, *args, **kwargs) -> HttpResponse: + if request.user.is_anonymous: + raise Http404() if not TaskUserAssignment.objects.filter( task_result__task_id=task_id, user=request.user ).exists():