diff --git a/epdb/legacy_api.py b/epdb/legacy_api.py index 1c24f538..4d16c3c3 100644 --- a/epdb/legacy_api.py +++ b/epdb/legacy_api.py @@ -45,7 +45,7 @@ from .models import ( User, UserPackagePermission, ) -from .views import get_remote_address +from .views import delete_with_log, get_remote_address Package = s.GET_PACKAGE_MODEL() @@ -567,7 +567,10 @@ def update_package(request, package_uuid, pack: Form[UpdatePackage]): if pack.hiddenMethod: if pack.hiddenMethod == "DELETE": - p.delete() + if PackageManager.administrable(request.user, p): + delete_with_log(request, p) + else: + raise ValueError("You do not have the rights to delete this Package!") elif pack.packageDescription is not None: description = nh3.clean(pack.packageDescription, tags=s.ALLOWED_HTML_TAGS).strip() @@ -604,7 +607,7 @@ def delete_package(request, package_uuid): p = PackageManager.get_package_by_id(request.user, package_uuid) if PackageManager.administrable(request.user, p): - p.delete() + delete_with_log(request, p) return redirect(f"{s.SERVER_URL}/package") else: raise ValueError("You do not have the rights to delete this Package!") @@ -1885,7 +1888,7 @@ def delete_pathway(request, package_uuid, pathway_uuid): p = get_package_for_write(request.user, package_uuid) pw = Pathway.objects.get(package=p, uuid=pathway_uuid) - pw.delete() + delete_with_log(request, pw) return redirect(f"{p.url}/pathway") except ValueError: @@ -2063,7 +2066,7 @@ def delete_node(request, package_uuid, pathway_uuid, node_uuid): pw = Pathway.objects.get(package=p, uuid=pathway_uuid) n = Node.objects.get(pathway=pw, uuid=node_uuid) - n.delete() + delete_with_log(request, n) return redirect(f"{pw.url}/node") except ValueError: @@ -2223,7 +2226,7 @@ def delete_edge(request, package_uuid, pathway_uuid, edge_uuid): pw = Pathway.objects.get(package=p, uuid=pathway_uuid) e = Edge.objects.get(pathway=pw, uuid=edge_uuid) - e.delete() + delete_with_log(request, e) return redirect(f"{pw.url}/edge") except ValueError: diff --git a/epdb/views.py b/epdb/views.py index 90e2aa09..26fdc4b3 100644 --- a/epdb/views.py +++ b/epdb/views.py @@ -166,9 +166,10 @@ def delete_with_log(request, obj): try: obj.delete() + auth_log.info(f"{caller.username} ({caller.url}) deleted {obj_type}: {obj.name} ({obj.url})") except Exception as e: logger.info(f"Tried to delete {obj_type}: {obj.name} ({obj.url}) but deletion failed! Exception {e}") - auth_log.error( + auth_log.info( f"{caller.username} ({caller.url}) tried to delete {obj_type}: {obj.name} ({obj.url}) but deletion failed!") raise e