Commit 1aec42d850192a226231a297fc834031feedb8aa
1 parent
c8db7577
Exists in
master
and in
2 other branches
modified permissions file from amadeus, so when a subject has no category, it wi…
…ll still work as expected and return False when a category or subject is null
Showing
2 changed files
with
17 additions
and
2 deletions
Show diff stats
amadeus/permissions.py
| @@ -30,10 +30,10 @@ def has_subject_permissions(user, subject): | @@ -30,10 +30,10 @@ def has_subject_permissions(user, subject): | ||
| 30 | if user.is_staff: | 30 | if user.is_staff: |
| 31 | return True | 31 | return True |
| 32 | 32 | ||
| 33 | - if subject.professor.filter(id = user.id).exists(): | 33 | + if subject.professor and subject.professor.filter(id = user.id).exists(): |
| 34 | return True | 34 | return True |
| 35 | 35 | ||
| 36 | - if subject.category.coordinators.filter(id = user.id).exists(): | 36 | + if subject.category and subject.category.coordinators.filter(id = user.id).exists(): |
| 37 | return True | 37 | return True |
| 38 | 38 | ||
| 39 | return False | 39 | return False |
reports/views.py
| @@ -24,11 +24,26 @@ import math | @@ -24,11 +24,26 @@ import math | ||
| 24 | from io import BytesIO | 24 | from io import BytesIO |
| 25 | import os | 25 | import os |
| 26 | import copy | 26 | import copy |
| 27 | +from django.shortcuts import render, get_object_or_404, redirect | ||
| 28 | + | ||
| 29 | +from amadeus.permissions import has_category_permissions, has_subject_permissions | ||
| 27 | 30 | ||
| 28 | class ReportView(LoginRequiredMixin, generic.FormView): | 31 | class ReportView(LoginRequiredMixin, generic.FormView): |
| 29 | template_name = "reports/create.html" | 32 | template_name = "reports/create.html" |
| 30 | form_class = CreateInteractionReportForm | 33 | form_class = CreateInteractionReportForm |
| 31 | 34 | ||
| 35 | + | ||
| 36 | + def dispatch(self, request, *args, **kwargs): | ||
| 37 | + params = self.request.GET | ||
| 38 | + subject = Subject.objects.get(id=params['subject_id']) | ||
| 39 | + | ||
| 40 | + if not has_subject_permissions(request.user, subject): | ||
| 41 | + return redirect(reverse_lazy('subjects:home')) | ||
| 42 | + | ||
| 43 | + | ||
| 44 | + | ||
| 45 | + return super(ReportView, self).dispatch(request, *args, **kwargs) | ||
| 46 | + | ||
| 32 | def get_initial(self): | 47 | def get_initial(self): |
| 33 | """ | 48 | """ |
| 34 | Returns the initial data to use for forms on this view. | 49 | Returns the initial data to use for forms on this view. |