Fixed OWASP-BLT#408. (OWASP-BLT#409)

sid22 · Sep 5, 2017 · 97cad47 · 97cad47
1 parent cd8f97f
commit 97cad47
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/website/views.py b/website/views.py
@@ -623,8 +623,8 @@ def post(self, request, *args, **kwargs):
 
 
 def UpdateIssue(request):
-    if request.method == "POST":
-        issue = Issue.objects.get(id=request.POST.get('issue_pk'))
+    issue = Issue.objects.get(id=request.POST.get('issue_pk'))
+    if request.method == "POST" and request.user.is_superuser or (issue is not None and request.user == issue.user):
         if request.POST.get('action') == "close":            
             issue.status = "closed"
             issue.closed_by = request.user