Преглед на файлове

fix removing member without permission (#16332)

Co-authored-by: crazywoola <427733928@qq.com>
Linh Nguyen преди 1 месец
родител
ревизия
8996c1da29
променени са 1 файла, в които са добавени 3 реда и са изтрити 1 реда
  1. 3 1
      api/services/account_service.py

+ 3 - 1
api/services/account_service.py

@@ -785,9 +785,11 @@ class TenantService:
     @staticmethod
     def remove_member_from_tenant(tenant: Tenant, account: Account, operator: Account) -> None:
         """Remove member from tenant"""
-        if operator.id == account.id and TenantService.check_member_permission(tenant, operator, account, "remove"):
+        if operator.id == account.id:
             raise CannotOperateSelfError("Cannot operate self.")
 
+        TenantService.check_member_permission(tenant, operator, account, "remove")
+
         ta = TenantAccountJoin.query.filter_by(tenant_id=tenant.id, account_id=account.id).first()
         if not ta:
             raise MemberNotInTenantError("Member not in tenant.")