notifications: do not notify anonymous user (#64497)

combo/apps/notifications/api_views.py

@@ -69,9 +69,20 @@ class Add(GenericAPIView):
             return Response(response, status.HTTP_400_BAD_REQUEST)
         payload = serializer.validated_data
         notification_ids = []
+        if payload.get('name_ids'):
+            # if name_ids were given, get the existing users
+            users = payload.get('users')
+        elif request.user and request.user.is_authenticated:
+            # if not, add notification to current user (it will usually be set
+            # via the custom PublikAuthentication djangorestfamework authentication
+            # class).
+            users = [request.user]
+        else:
+            response = {'err': 1, 'err_desc': 'no users given'}
+            return Response(response, status.HTTP_400_BAD_REQUEST)
         try:
             with transaction.atomic():
-                for user in payload.get('users') or [request.user]:
+                for user in users:
                     notification = Notification.notify(
                         user=user,
                         summary=payload['summary'],