made the reviewed changes

OWASP-BLT · Jul 20, 2024 · f134d2f · f134d2f
1 parent e58032c
commit f134d2f
Show file tree

Hide file tree

Showing 7 changed files with 18 additions and 121 deletions.
diff --git a/website/api/views.py b/website/api/views.py
@@ -11,7 +11,12 @@
 from rest_framework import filters, status, viewsets
 from rest_framework.authentication import TokenAuthentication
 from rest_framework.pagination import PageNumberPagination
-from rest_framework.permissions import AllowAny, IsAuthenticated, IsAuthenticatedOrReadOnly
+from rest_framework.permissions import (
+    AllowAny,
+    IsAdminUser,
+    IsAuthenticated,
+    IsAuthenticatedOrReadOnly,
+)
 from rest_framework.response import Response
 from rest_framework.views import APIView
 
@@ -659,7 +664,6 @@ class CompanyViewSet(viewsets.ModelViewSet):
 class ContributorViewSet(viewsets.ModelViewSet):
     queryset = Contributor.objects.all()
     serializer_class = ContributorSerializer
-    permission_classes = (IsAuthenticatedOrReadOnly,)
     http_method_names = ("get", "post", "put")
 
 
@@ -721,11 +725,16 @@ def list(self, request, *args, **kwargs):
         )
 
     def update(self, request, *args, **kwargs):
-        projects = Project.objects.prefetch_related("contributors").all()
-        for project in projects:
-            contributors = Project.get_contributors(self, github_url=project.github_url)
-            project.contributors.set(contributors)
-        serializer = ProjectSerializer(projects, many=True)
+        if IsAdminUser.has_permission(self=self, request=request, view=""):
+            projects = Project.objects.prefetch_related("contributors").all()
+            for project in projects:
+                contributors = Project.get_contributors(self, github_url=project.github_url)
+                project.contributors.set(contributors)
+            serializer = ProjectSerializer(projects, many=True)
+            return Response(
+                {"count": len(projects), "projects": serializer.data}, status=status.HTTP_200_OK
+            )
         return Response(
-            {"count": len(projects), "projects": serializer.data}, status=status.HTTP_200_OK
+            {"success": False, "message": "Only admin's can access this api."},
+            status=status.HTTP_400_BAD_REQUEST,
         )
diff --git a/website/migrations/0097_contributor_project_contributors.py b/website/migrations/0097_contributor_project_contributors.py
diff --git a/website/migrations/0098_alter_contributor_github_id.py b/website/migrations/0098_alter_contributor_github_id.py
diff --git a/website/migrations/0099_alter_contributor_github_id.py b/website/migrations/0099_alter_contributor_github_id.py
diff --git a/website/migrations/0100_alter_contributor_github_id.py b/website/migrations/0100_alter_contributor_github_id.py
diff --git a/website/migrations/0101_rename_avatar_contributor_avatar_url_and_more.py b/website/migrations/0101_rename_avatar_contributor_avatar_url_and_more.py
diff --git a/website/models.py b/website/models.py
@@ -694,7 +694,7 @@ def get_contributors(self, github_url):
                         defaults={
                             "name": c["login"],
                             "github_url": c["html_url"],
-                            "avatar": c["avatar_url"],
+                            "avatar_url": c["avatar_url"],
                             "contributor_type": c["type"],
                             "contributions": c["contributions"],
                         },