hazza/DSpace
1
0
Fork 0
mirror of https://github.com/DSpace/DSpace.git synced 2025-10-18 07:23:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

[DURACOM-357] improved check for authorization on objects in ItemConverter

Browse Source 
(cherry picked from commit a70dede20b)
This commit is contained in:
Stefano Maffei
2025-04-30 08:31:01 +02:00
committed by github-actions[bot]
parent b74c4b958f
commit 371d470891
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
dspace-server-webapp/src/main/java/org/dspace/app/rest/converter/ItemConverter.java
View File

@@ -76,7 +76,7 @@ public class ItemConverter
try { try {
if (obj.isWithdrawn() && (Objects.isNull(context) || if (obj.isWithdrawn() && (Objects.isNull(context) ||
Objects.isNull(context.getCurrentUser()) || Objects.isNull(context.getCurrentUser()) ||
!(authorizeService.isAdmin(context) || authorizeService.isCollectionAdmin(context)))) { !(authorizeService.isAdmin(context) || authorizeService.isAdmin(context, obj)))) {
return new MetadataValueList(List.of()); return new MetadataValueList(List.of());
} }
if (context != null && (authorizeService.isAdmin(context) || itemService.canEdit(context, obj))) { if (context != null && (authorizeService.isAdmin(context) || itemService.canEdit(context, obj))) {