Casts a repo object before checking permission

fixes: pulp#5619
git-hyagi · Jul 22, 2024 · fa9acc1 · fa9acc1
1 parent 2c08679
commit fa9acc1
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/CHANGES/5619.bufix b/CHANGES/5619.bufix
@@ -0,0 +1 @@
+Fixed a bug where containers couldn't be built from repository versions when using RBAC.
diff --git a/pulpcore/app/global_access_conditions.py b/pulpcore/app/global_access_conditions.py
@@ -479,9 +479,9 @@ def has_repo_or_repo_ver_param_model_or_obj_perms(request, view, action, permiss
     )
     serializer.is_valid(raise_exception=True)
     if repository := serializer.validated_data.get("repository"):
-        return request.user.has_perm(permission, repository)
+        return request.user.has_perm(permission, repository.cast())
     elif repo_ver := serializer.validated_data.get("repository_version"):
-        return request.user.has_perm(permission, repo_ver.repository)
+        return request.user.has_perm(permission, repo_ver.repository.cast())
     return True