diff --git a/server/AyaNova/Controllers/DashboardViewController.cs b/server/AyaNova/Controllers/DashboardViewController.cs index a54a965e..cbfcfba4 100644 --- a/server/AyaNova/Controllers/DashboardViewController.cs +++ b/server/AyaNova/Controllers/DashboardViewController.cs @@ -59,8 +59,9 @@ namespace AyaNova.Api.Controllers //Instantiate the business object handler DashboardViewBiz biz = DashboardViewBiz.GetBiz(ct, HttpContext); - if (!Authorized.HasReadFullRole(HttpContext.Items, biz.BizType)) - return StatusCode(403, new ApiNotAuthorizedResponse()); + //user always has full access to their own dashboard view and can only access their own through api so no need to check + // if (!Authorized.HasReadFullRole(HttpContext.Items, biz.BizType)) + // return StatusCode(403, new ApiNotAuthorizedResponse()); if (!ModelState.IsValid) return BadRequest(new ApiErrorResponse(ModelState)); @@ -96,8 +97,9 @@ namespace AyaNova.Api.Controllers if (o == null) return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND)); - if (!Authorized.HasModifyRole(HttpContext.Items, biz.BizType)) - return StatusCode(403, new ApiNotAuthorizedResponse()); + //user always has full access to their own dashboard view and can only access their own through api so no need to check + // if (!Authorized.HasModifyRole(HttpContext.Items, biz.BizType)) + // return StatusCode(403, new ApiNotAuthorizedResponse()); try {