Version: 7.5 (likely most if not all previous)
Steps to Recreate:
- generate API key using manage.py
- upload item as any user other than admin
- Modify that item using the api
- Status code 200 from the api shows everything ok
- View the item in the web interface
- Observe ownership is now incorrectly attributed to admin
Root Cause:
In media.py, the MediaDetail.put() handler executes:
serializer.save(user=request.user)
Even though user is declared ReadOnlyField in the serializer (so the client can't write it), the view layer explicitly overrides it with the request user on every save.
A really convoluted workaround using bulk actions and parsing full paths to the original upload to recover the username are the only current solution.
Version: 7.5 (likely most if not all previous)
Steps to Recreate:
Root Cause:
In media.py, the MediaDetail.put() handler executes:
Even though user is declared ReadOnlyField in the serializer (so the client can't write it), the view layer explicitly overrides it with the request user on every save.
A really convoluted workaround using bulk actions and parsing full paths to the original upload to recover the username are the only current solution.