From 82af8520fce7d2cfe2c9f0c001473154f2b7d199 Mon Sep 17 00:00:00 2001
From: Tom Teichler <tom.teichler@teckids.org>
Date: Sun, 19 Jun 2022 22:28:28 +0200
Subject: [PATCH] Fix event detail view permissions
---
aleksis/apps/paweljong/rules.py | 6 +++++-
aleksis/apps/paweljong/views.py | 2 +-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/aleksis/apps/paweljong/rules.py b/aleksis/apps/paweljong/rules.py
index 0727b2a..7683d6d 100644
--- a/aleksis/apps/paweljong/rules.py
+++ b/aleksis/apps/paweljong/rules.py
@@ -1,4 +1,4 @@
-import rules
+import rules;
from aleksis.core.util.predicates import (
has_any_object,
@@ -65,6 +65,10 @@ view_event_predicate = (
)
rules.add_perm("paweljong.view_event_rule", view_event_predicate)
+# Event organiser view
+view_event_detail_predicate = (has_person & is_organiser)
+rules.add_perm("paweljong.view_event_detail_rule", view_event_detail_predicate)
+
# Delete event
delete_event_predicate = has_person & (
has_global_perm("paweljong.delete_event") | has_object_perm("paweljong.delete_event")
diff --git a/aleksis/apps/paweljong/views.py b/aleksis/apps/paweljong/views.py
index 79de5e2..7065c2a 100644
--- a/aleksis/apps/paweljong/views.py
+++ b/aleksis/apps/paweljong/views.py
@@ -898,7 +898,7 @@ class EventDetailView(PermissionRequiredMixin, DetailView):
"""Detail view for an event instance."""
context_object_name = "event"
- permission_required = "paweljong.view_event_rule"
+ permission_required = "paweljong.view_event_detail_rule"
template_name = "paweljong/event/detail.html"
model = Event
slug_field = "slug"
--
GitLab