Only allow resubmission of accessible jobs

2023-12-11 21:36:21 +01:00 · 2023-12-11 21:36:21 +01:00 · b4e1b912ce
parent c2bdab5b75
commit b4e1b912ce
1 changed files with 2 additions and 0 deletions
--- a/buildsrht/blueprints/jobs.py
+++ b/buildsrht/blueprints/jobs.py
@ -242,6 +242,8 @@ def resubmit_GET(job_id):
    job = Job.query.filter(Job.id == job_id).one_or_none()
    if not job:
        abort(404)
+    if not get_access(job):
+        abort(404)
    session["manifest"] = job.manifest
    if isinstance(job.note, str) and len(job.note.splitlines()) == 1:
        note = addsuffix(job.note, "(resubmitted)")