From 1c2e8e1ce7dc9fdee022e4a98724f828a1348e0f Mon Sep 17 00:00:00 2001 From: Xiyuan Chen <52963600+GareArc@users.noreply.github.com> Date: Tue, 6 May 2025 03:41:50 -0400 Subject: [PATCH] fix removing member without permission (#16332) (#19275) Co-authored-by: Linh Nguyen <55907715+batman0911@users.noreply.github.com> Co-authored-by: crazywoola <427733928@qq.com> --- api/services/account_service.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/api/services/account_service.py b/api/services/account_service.py index b11815664e..eba9f3bdbb 100644 --- a/api/services/account_service.py +++ b/api/services/account_service.py @@ -776,9 +776,11 @@ class TenantService: @staticmethod def remove_member_from_tenant(tenant: Tenant, account: Account, operator: Account) -> None: """Remove member from tenant""" - if operator.id == account.id and TenantService.check_member_permission(tenant, operator, account, "remove"): + if operator.id == account.id: raise CannotOperateSelfError("Cannot operate self.") + TenantService.check_member_permission(tenant, operator, account, "remove") + ta = TenantAccountJoin.query.filter_by(tenant_id=tenant.id, account_id=account.id).first() if not ta: raise MemberNotInTenantError("Member not in tenant.")