diff --git a/flask_admin/base.py b/flask_admin/base.py index d6dc49abd..bce8e242a 100644 --- a/flask_admin/base.py +++ b/flask_admin/base.py @@ -417,8 +417,9 @@ def _handle_view(self, name: str, **kwargs: dict[str, t.Any]) -> t.Any: :param kwargs: View function arguments """ + # abort(403) if not self.is_accessible(): - return self.inaccessible_callback(name, **kwargs) + return self.inaccessible_callback(name, **kwargs) or abort(403) def _run_view( self, fn: t.Callable[..., t.Any], *args: t.Any, **kwargs: t.Any diff --git a/flask_admin/tests/test_base.py b/flask_admin/tests/test_base.py index 778255db8..04c191599 100644 --- a/flask_admin/tests/test_base.py +++ b/flask_admin/tests/test_base.py @@ -320,6 +320,13 @@ def test_inaccessible_callback(app, admin): rv = client.get("/admin/mockview/") assert rv.status_code == 418 + # if inaccessible_callback returns None + view.allow_access = False + view.inaccessible_callback = lambda *args, **kwargs: None # type: ignore[method-assign] + + rv = client.get("/admin/mockview/") + assert rv.status_code == 403 + def get_visibility(app, admin): view = MockView(name="TestMenuItem")