diff --git a/datasette/views/special.py b/datasette/views/special.py index 6fcb6b5e..6c378995 100644 --- a/datasette/views/special.py +++ b/datasette/views/special.py @@ -80,7 +80,8 @@ class PermissionsDebugView(BaseView): async def get(self, request): await self.check_permission(request, "view-instance") - await self.check_permission(request, "permissions-debug") + if not await self.ds.permission_allowed(request.actor, "permissions-debug"): + return Response("Permission denied", status=403) return await self.render( ["permissions_debug.html"], request, diff --git a/tests/test_permissions.py b/tests/test_permissions.py index fcc1b5ed..241dd2e5 100644 --- a/tests/test_permissions.py +++ b/tests/test_permissions.py @@ -305,7 +305,9 @@ def test_permissions_debug(app_client): ] assert [ {"action": "permissions-debug", "result": True, "used_default": False}, + {"action": "view-instance", "result": True, "used_default": True}, {"action": "permissions-debug", "result": False, "used_default": True}, + {"action": "view-instance", "result": True, "used_default": True}, ] == checks