Not allowing editing mailing list if not logged

Sergio Oliveira
1 parent 2d2122c8
Showing 1 changed file with 8 additions and 0 deletions Show diff stats
src/accounts/views.py
@@ -129,6 +129,14 @@ class ManageUserSubscriptionsView(UserProfileBaseMixin, DetailView):
     http_method_names = [u'get', u'post']
     template_name = u'accounts/manage_subscriptions.html'
+    def get_object(self, *args, **kwargs):
+        obj = super(ManageUserSubscriptionsView, self).get_object(*args,
+                                                                  **kwargs)
+        if self.request.user != obj and not self.request.user.is_superuser:
+            raise PermissionDenied
+
+        return obj
+
     def post(self, request, *args, **kwargs):
         user = self.get_object()
         for email in user.emails.values_list('address', flat=True):
	@@ -129,6 +129,14 @@ class ManageUserSubscriptionsView(UserProfileBaseMixin, DetailView):		@@ -129,6 +129,14 @@ class ManageUserSubscriptionsView(UserProfileBaseMixin, DetailView):
129	http_method_names = [u'get', u'post']	129	http_method_names = [u'get', u'post']
130	template_name = u'accounts/manage_subscriptions.html'	130	template_name = u'accounts/manage_subscriptions.html'
131		131
		132	+ def get_object(self, args, *kwargs):
		133	+ obj = super(ManageUserSubscriptionsView, self).get_object(*args,
		134	+ **kwargs)
		135	+ if self.request.user != obj and not self.request.user.is_superuser:
		136	+ raise PermissionDenied
		137	+
		138	+ return obj
		139	+
132	def post(self, request, args, *kwargs):	140	def post(self, request, args, *kwargs):
133	user = self.get_object()	141	user = self.get_object()
134	for email in user.emails.values_list('address', flat=True):	142	for email in user.emails.values_list('address', flat=True):