From f5a5782bacbe66388d560c13b70480c4488310f1 Mon Sep 17 00:00:00 2001 From: imperosol Date: Mon, 26 Oct 2026 22:57:30 +0100 Subject: [PATCH] fix: privilege escalation for `DeleteAllForumUserMessagesView` --- rootplace/views.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/rootplace/views.py b/rootplace/views.py index 930f3b45..c1f11c71 100644 --- a/rootplace/views.py +++ b/rootplace/views.py @@ -184,10 +184,9 @@ class DeleteAllForumUserMessagesView(FormView): form_class = SelectUserForm def dispatch(self, request, *args, **kwargs): - res = super().dispatch(request, *args, **kwargs) - if request.user.is_root: - return res - raise PermissionDenied + if not request.user.is_root: + raise PermissionDenied + return super().dispatch(request, *args, **kwargs) def form_valid(self, form): self.user = form.cleaned_data["user"]