Not allowing editing mailing list if not logged

Sergio Oliveira
1 parent 2d2122c8
Showing 1 changed file with 8 additions and 0 deletions Show diff stats
src/accounts/views.py
@@ -129,6 +129,14 @@ class ManageUserSubscriptionsView(UserProfileBaseMixin, DetailView):
     http_method_names = [u'get', u'post']
     template_name = u'accounts/manage_subscriptions.html'
  
+    def get_object(self, *args, **kwargs):
+        obj = super(ManageUserSubscriptionsView, self).get_object(*args,
+                                                                  **kwargs)
+        if self.request.user != obj and not self.request.user.is_superuser:
+            raise PermissionDenied
+
+        return obj
+
     def post(self, request, *args, **kwargs):
         user = self.get_object()
         for email in user.emails.values_list('address', flat=True):
...	...	@@ -129,6 +129,14 @@ class ManageUserSubscriptionsView(UserProfileBaseMixin, DetailView):
129	129	http_method_names = [u'get', u'post']
130	130	template_name = u'accounts/manage_subscriptions.html'
131	131
	132	+ def get_object(self, args, *kwargs):
	133	+ obj = super(ManageUserSubscriptionsView, self).get_object(*args,
	134	+ **kwargs)
	135	+ if self.request.user != obj and not self.request.user.is_superuser:
	136	+ raise PermissionDenied
	137	+
	138	+ return obj
	139	+
132	140	def post(self, request, args, *kwargs):
133	141	user = self.get_object()
134	142	for email in user.emails.values_list('address', flat=True):
...	...