Check corpus permission in manifest search

arkindex/documents/api/iiif.py

@@ -2,6 +2,7 @@ from django.conf import settings
 from django.utils.decorators import method_decorator
 from django.views.decorators.cache import cache_page
 from rest_framework.generics import RetrieveAPIView
+from rest_framework.exceptions import PermissionDenied
 from arkindex.documents.models import Element, ElementType, Page, Act, Transcription, Corpus
 from arkindex.documents.serializers.iiif import \
     VolumeManifestSerializer, ActManifestSerializer, \
@@ -106,10 +107,9 @@ class TranscriptionSearchAnnotationList(SearchAPIMixin, RetrieveAPIView):
 
     def get_element(self):
         if not self.elt:
-            self.elt = Element.objects.get(
-                corpus__in=Corpus.objects.readable(self.request.user),
-                id=self.kwargs['pk'],
-            )
+            self.elt = Element.objects.get(id=self.kwargs['pk'])
+            if self.elt.corpus not in Corpus.objects.readable(self.request.user):
+                raise PermissionDenied
         return self.elt
 
     def get_context(self):