Fix: prevent note deletion outside doc

This commit is contained in:
shamoon 2026-01-29 13:29:30 -08:00
parent 6913f9d79c
commit e4b861d76f
No known key found for this signature in database

View File

@ -1099,7 +1099,7 @@ class DocumentViewSet(
):
return HttpResponseForbidden("Insufficient permissions to delete notes")
note = Note.objects.get(id=int(request.GET.get("id")))
note = Note.objects.get(id=int(request.GET.get("id")), document=doc)
if settings.AUDIT_LOG_ENABLED:
LogEntry.objects.log_create(
instance=doc,