From c3b9888b310fb0632cc25b114e33688f715bfcc9 Mon Sep 17 00:00:00 2001 From: Ozzieisaacs Date: Thu, 3 Dec 2020 09:42:41 +0100 Subject: [PATCH] Fix #1739 (opds download with anonymous browsing enabled) -> download rights of guest user are now respected again --- cps/opds.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cps/opds.py b/cps/opds.py index 9cba6fa5..05e9c68c 100644 --- a/cps/opds.py +++ b/cps/opds.py @@ -387,8 +387,8 @@ def opds_download_link(book_id, book_format): # I gave up with this: With enabled ldap login, the user doesn't get logged in, therefore it's always guest # workaround, loading the user from the request and checking it's download rights here # in case of anonymous browsing user is None - user = load_user_from_request(request) - if not user or not user.role_download(): + user = load_user_from_request(request) or current_user + if not user.role_download(): return abort(403) if "Kobo" in request.headers.get('User-Agent'): client = "kobo"