search

inveniosoftware / invenio-records-resources

Records REST APIs for Invenio.
https://invenio-records-resources.readthedocs.io
MIT License
4 stars 48 forks source link

Restrict modifications on files of deleted records #512

Closed jrcastro2 closed 11 months ago

jrcastro2 commented 11 months ago 
          normally I would say you should not be able to set_file_content on deleted record unless for some reason the admin's job requires it. I would ask the zenodo support team for their use cases

I see two options

  1. this endpoint should be protected by permissions, and only admin should be able to set content/commit - in this case we miss a test to check if normal user or owner of the record still can commit files
  2. nobody, even the admin/moderator (except superuse) should be able to commit or set content

_Originally posted by @kpsherva in https://github.com/inveniosoftware/invenio-records-resources/pull/511#discussion_r1337075507_

kpsherva commented 11 months ago

done