diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 7b9ad6b2b1571dfd7a73c8d0c76753ed71f28055..9733950e5dabb8eace35542bafc518a1c5f4173b 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -6,6 +6,14 @@ All notable changes to this project will be documented in this file. The format is based on `Keep a Changelog`_, and this project adheres to `Semantic Versioning`_. +Unreleased +---------- + +Fixed +~~~~~ +* The view for getting the progress of celery tasks didn't respect that there can be anonymous users. + + `2.0rc4`_ - 2021-08-01 ---------------------- diff --git a/aleksis/core/views.py b/aleksis/core/views.py index c2b113b67299626f44d90d88c29f23e025e7633f..e24bafa1705465173a8ae9d54669ae23d880ee04 100644 --- a/aleksis/core/views.py +++ b/aleksis/core/views.py @@ -1151,6 +1151,8 @@ class CeleryProgressView(View): """Wrap celery-progress view to check permissions before.""" def get(self, request: HttpRequest, task_id: str, *args, **kwargs) -> HttpResponse: + if request.user.is_anonymous: + raise Http404() if not TaskUserAssignment.objects.filter( task_result__task_id=task_id, user=request.user ).exists():