diff --git a/catalog/templates/catalog_edit.html b/catalog/templates/catalog_edit.html index 85002483..30ed0a4d 100644 --- a/catalog/templates/catalog_edit.html +++ b/catalog/templates/catalog_edit.html @@ -76,7 +76,7 @@ {% if not item.show or request.user.is_superuser %}
{% trans '将本季关联到电视剧' %}
-
+ {% csrf_token %}
diff --git a/catalog/views.py b/catalog/views.py index d2ca3713..6d8ce067 100644 --- a/catalog/views.py +++ b/catalog/views.py @@ -230,13 +230,13 @@ def assign_parent(request, item_path, item_uuid): if request.method != "POST": raise BadRequest() item = get_object_or_404(Item, uid=get_uuid_or_404(item_uuid)) - if not request.user.is_superuser and not item.deletable: - raise PermissionDenied() new_item = Item.get_by_url(request.POST.get("parent_item_url")) if not new_item or new_item.is_deleted or new_item.merged_to_item_id: raise BadRequest("Can't assign parent to a deleted or redirected item") if item.__class__ != TVSeason or new_item.__class__ != TVShow: raise BadRequest("Can't assign parent for this item") + if not request.user.is_superuser and item.show: + raise PermissionDenied() _logger.warn(f"{request.user} assign {item} to {new_item}") item.show = new_item item.save(update_fields=["show"])