diff --git a/containers/backupchecks/src/backend/app/main/routes_feedback.py b/containers/backupchecks/src/backend/app/main/routes_feedback.py index 8318548..e7271fd 100644 --- a/containers/backupchecks/src/backend/app/main/routes_feedback.py +++ b/containers/backupchecks/src/backend/app/main/routes_feedback.py @@ -489,9 +489,11 @@ def feedback_attachment(attachment_id: int): """Serve a feedback attachment image.""" attachment = FeedbackAttachment.query.get_or_404(attachment_id) - # Check if the feedback item is deleted + # Check if the feedback item is deleted - allow admins to view item = FeedbackItem.query.get(attachment.feedback_item_id) - if not item or item.deleted_at is not None: + if not item: + abort(404) + if item.deleted_at is not None and get_active_role() != "admin": abort(404) # Serve the image diff --git a/containers/backupchecks/src/templates/main/feedback.html b/containers/backupchecks/src/templates/main/feedback.html index 6a553c0..70e09f6 100644 --- a/containers/backupchecks/src/templates/main/feedback.html +++ b/containers/backupchecks/src/templates/main/feedback.html @@ -69,7 +69,7 @@ {% endif %} {% for i in items %} - + {% if not i.is_deleted %}