Merge branch 'develop' into 'main'

fix: Validate team ID in shared member retrieval, update URL patterns, and ignore .DS_Store

See merge request locker/api-core!609

Author: khaitranquang

.gitignore

@@ -61,3 +61,5 @@ crashlytics-build.properties
 fabric.properties
 log.txt
 
+#
+.DS_Store

locker_server/api/v1_0/sharing/views.py

@@ -439,6 +439,8 @@ def update_role(self, request, *args, **kwargs):
         # Retrieve member that accepted
         try:
             member = self.sharing_service.get_shared_member(sharing_member_id=member_id)
+            if str(member.team.team_id) != str(kwargs.get("pk")):
+                raise NotFound
         except TeamMemberDoesNotExistException:
             raise NotFound
 

locker_server/api/v1_0/urls.py

@@ -224,7 +224,7 @@
 
     re_path(r'^payments/invoices$', views.PaymentPwdViewSet.as_view({'get': 'invoices'})),
     re_path(r'^payments/invoices/(?P<pk>[A-Z0-9]+)$',
-        views.PaymentPwdViewSet.as_view({'get': 'retrieve_invoice', 'post': 'retry_invoice'})),
+        views.PaymentPwdViewSet.as_view({'get': 'retrieve_invoice',})),
 ]
 
 # -------------------------------- Family Plan members  ------------------------------------- #