aiolabs/lnbits
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

fix another super_user permission issue

Browse source
This commit is contained in:
dni ⚡ 2022-12-06 13:04:27 +01:00
parent aafb2335a1
commit f2da8fc277
2 changed files with 1 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lnbits/decorators.py
View file

@ -146,8 +146,7 @@ async def get_key_type(
status_code=HTTPStatus.NOT_FOUND, detail="Wallet does not exist." status_code=HTTPStatus.NOT_FOUND, detail="Wallet does not exist."
) )
if ( if (
wallet.wallet.user != settings.super_user wallet.wallet.user != settings.super_user and wallet.wallet.user not in settings.lnbits_admin_users
or wallet.wallet.user not in settings.lnbits_admin_users
) and ( ) and (
settings.lnbits_admin_extensions settings.lnbits_admin_extensions
and pathname in settings.lnbits_admin_extensions and pathname in settings.lnbits_admin_extensions

4
lnbits/extensions/admin/crud.py
View file

@ -39,10 +39,6 @@ async def delete_admin_settings():
async def update_admin_settings(data: UpdateSettings): async def update_admin_settings(data: UpdateSettings):
# TODO why are those field here, they are not in UpdateSettings
# TODO: why is UpdateSettings of type dict here? thats why type:ignore is needed
data.pop("lnbits_allowed_funding_sources") # type: ignore
data.pop("super_user") # type: ignore
q, values = get_q_and_values(data) q, values = get_q_and_values(data)
await db.execute(f"UPDATE admin.settings SET {q}", (values,)) # type: ignore await db.execute(f"UPDATE admin.settings SET {q}", (values,)) # type: ignore