From ec87474d4573ef05aeaa45780416620dc3d05548 Mon Sep 17 00:00:00 2001 From: Yongtao Huang Date: Sat, 13 Sep 2025 23:40:59 +0800 Subject: [PATCH] Fix worng permission logic --- api/controllers/console/datasets/datasets.py | 2 +- api/controllers/console/datasets/external.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/api/controllers/console/datasets/datasets.py b/api/controllers/console/datasets/datasets.py index 3834daa007..823cf6a9e7 100644 --- a/api/controllers/console/datasets/datasets.py +++ b/api/controllers/console/datasets/datasets.py @@ -339,7 +339,7 @@ class DatasetApi(Resource): dataset_id_str = str(dataset_id) # The role of the current user in the ta table must be admin, owner, or editor - if not current_user.is_editor or current_user.is_dataset_operator: + if not (current_user.is_editor or current_user.is_dataset_operator): raise Forbidden() try: diff --git a/api/controllers/console/datasets/external.py b/api/controllers/console/datasets/external.py index 043f39f623..e149d550e7 100644 --- a/api/controllers/console/datasets/external.py +++ b/api/controllers/console/datasets/external.py @@ -131,7 +131,7 @@ class ExternalApiTemplateApi(Resource): external_knowledge_api_id = str(external_knowledge_api_id) # The role of the current user in the ta table must be admin, owner, or editor - if not current_user.is_editor or current_user.is_dataset_operator: + if not (current_user.is_editor or current_user.is_dataset_operator): raise Forbidden() ExternalDatasetService.delete_external_knowledge_api(current_user.current_tenant_id, external_knowledge_api_id)