Issue #104 restrict access to edit property page

LesFruitsDefendus · Jun 16, 2021 · 8b926b0 · 8b926b0
1 parent f4156f7
commit 8b926b0
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 3 deletions.
diff --git a/saskatoon/harvest/api.py b/saskatoon/harvest/api.py
@@ -1,6 +1,7 @@
 from dal import autocomplete
 from django.contrib import messages
 from django.contrib.messages.views import SuccessMessageMixin
+from django.contrib.auth.mixins import PermissionRequiredMixin
 from django.http import HttpResponseRedirect
 from django.urls import reverse_lazy
 from rest_framework.response import Response
@@ -259,7 +260,8 @@ class PropertyCreatePublicView(SuccessMessageMixin, CreateView):
     success_url = 'thanks'
     success_message = 'Thanks for adding your property! In case you authorized a harvest for this season, please read the <a href="https://core.lesfruitsdefendus.org/s/bnKoECqGHAbXQqm">Tree Owner Welcome Notice</a>.'
 
-class PropertyUpdateView(LoginRequiredMixin, SuccessMessageMixin, UpdateView):
+class PropertyUpdateView(PermissionRequiredMixin, SuccessMessageMixin, UpdateView):
+    permission_required = 'harvest.change_property'
     model = Property
     form_class = PropertyForm
     template_name = 'app/property_create.html'

diff --git a/saskatoon/sitebase/templates/app/property_details.html b/saskatoon/sitebase/templates/app/property_details.html
@@ -37,9 +37,12 @@ <h4>** PENDING **</h4>
                         </div>
                         <div class="col-lg-2 col-md-2 col-sm-2 col-xs-2">
                             <div class="breadcomb-report">
+                                {% if perms.harvest.change_property %}
                                 <a href="/property/update/{{ property.id }}">
-                                <button data-placement="left" title="Edit property" class="btn">Edit</button>
+                                    <button data-placement="left" title="Edit property" class="btn">
+                                        Edit</button>
                                 </a>
+                                {% endif %}
                             </div>
                         </div>
                     </div>
@@ -93,7 +96,7 @@ <h2>{% trans "Owner" %}
                             </h2>
                         {% else %}
                             <h2>{% trans "Contact" %}
-                            {% if perms.member.change_person %}
+                            {% if perms.member.add_person %}
                                 &nbsp;
                                 <small><a href="/person/create/?pid={{property.id}}">
                                         <i class="fa fa-pencil"></i> register