Skip to content

Conversation

@stktyagi
Copy link
Member

Adding organization_lookup = 'organization__in' to the view forces it to use the correct organization field and prevents the crash.

Fixes #1110

Checklist

  • I have read the OpenWISP Contributing Guidelines.
  • I have manually tested the changes proposed in this pull request.
  • I have written new test cases for new code and/or updated existing tests for changes to existing code.
  • I have updated the documentation.

Reference to Existing Issue

Closes #1110

Description of Changes

The permission mixin was incorrectly using the child's organization path (content_object__organization) to filter the parent Device including organization_lookup = 'organization__in' to the view fixes it.

Adding organization_lookup = 'organization__in' to the view forces it to use the correct organization field and prevents the crash.

Fixes #1110
@coveralls
Copy link

coveralls commented Oct 24, 2025

Coverage Status

coverage: 98.607%. remained the same
when pulling 70c1c7b on issues/1110-crash-without-superuser-permission
into 691bae8 on master.

Copy link
Member

@nemesifier nemesifier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need a test which replicates the bug and fails without the patch, otherwise another contributor may inadvertently break this again in the future.

This test confirms the API correctly returns a 404 Not Found instead of crashing with a 500 FieldError.

Fixes #1110
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[bug] Crash when accessing "api/v1/controller/device/[device UUID]/location/" without Superuser permssions

4 participants