diff --git a/backend/boards/views.py b/backend/boards/views.py index 1a3bd5a..8b3fd47 100644 --- a/backend/boards/views.py +++ b/backend/boards/views.py @@ -23,9 +23,9 @@ class ListBoardViewSet(viewsets.ModelViewSet): return queryset def create(self, request, *args, **kwargs): - request.data['board'] = request.data.get('board') # Make sure 'board' is in request data - board_user_id = ListBoard.objects.get(id=request.data['board']).board.request.user.id - if request.user.id != board_user_id: + board_id = request.data.get('board') + board = Board.objects.get(id=board_id) + if request.user.id != board.user.id: return Response({"error": "Cannot create ListBoard for another user's board."}, status=status.HTTP_403_FORBIDDEN) return super().create(request, *args, **kwargs) diff --git a/backend/tasks/tasks/views.py b/backend/tasks/tasks/views.py index 4fc407d..5d948dc 100644 --- a/backend/tasks/tasks/views.py +++ b/backend/tasks/tasks/views.py @@ -20,6 +20,7 @@ class TodoViewSet(viewsets.ModelViewSet): queryset = Todo.objects.all() serializer_class = TaskSerializer permission_classes = [IsAuthenticated] + model = Todo def get_queryset(self): queryset = Todo.objects.filter(user=self.request.user)