fix delete token. only user tokens allowed

2024-09-20 14:30:31 +02:00 · 2024-09-20 14:30:31 +02:00 · f5f0ea3c35
parent 2f4a85f79b
commit f5f0ea3c35
1 changed files with 1 additions and 1 deletions
--- a/api/views.py
+++ b/api/views.py
@ -99,7 +99,7 @@ class TokenDeleteView(DashboardView, DeleteView):

    def get(self, request, *args, **kwargs):
        self.pk = kwargs['pk']
-        self.object = get_object_or_404(self.model, pk=self.pk)
+        self.object = get_object_or_404(self.model, pk=self.pk, owner=self.request.user)
        self.object.delete()

        return redirect('api:tokens')