Validation in create group API

[ClawedCatalyst]

In mailer/views.py, at line 31, there is a POST API for creating a group.
Currently, there seems to be no validation regarding the user ID.

Here's the issue:

I can simply pass a user token and create a group with a different user ID. Consequently, the group is added to the account associated with the user ID that was passed.

Here's what should happen:

When a different user's ID is passed, it should raise an error, indicating 'permission denied.'"

[lakshay-saini-au8]

@ClawedCatalyst I would like work on this

[ClawedCatalyst]

lakshay-saini-au8 sure you can

[kiranrokkam09]

I would like to contribute to this issue. Is anybody working with it?

[ClawedCatalyst]

you can start on this @kiranrokkam09 :)

[kiranrokkam09]

You are saying that only authenticated users can make a POST request to the endpoint.

[ClawedCatalyst]

Yes only authenticated and id of user should be the authenticated user.
If I pass a different user id it should raise an error @kiranrokkam09

[kiranrokkam09]

@ClawedCatalyst you can check the pull request made by me. I added the following code:

[lakshay-saini-au8]

@ClawedCatalyst Sorry for the dealy
here is the change please do review #17