Adapt menus and urls for right management - check_rights_condition for filtering wizard steps

14 files changed, 324 insertions, 199 deletions

diff --git a/archaeological_context_records/ishtar_menu.py b/archaeological_context_records/ishtar_menu.py
index 49f92ad89..826f99b0f 100644
--- a/archaeological_context_records/ishtar_menu.py
+++ b/archaeological_context_records/ishtar_menu.py
@@ -23,6 +23,8 @@ from ishtar_common.menu_base import SectionItem, MenuItem
 
 import models
 
+# be carreful: each access_controls must be relevant with check_rights in urls
+
 MENU_SECTIONS = [
     (40, SectionItem('record_management', _(u"Context record"),
      childs=[MenuItem('record_search', _(u"Search"),
diff --git a/archaeological_context_records/urls.py b/archaeological_context_records/urls.py
index 098542fa0..7487c39c5 100644
--- a/archaeological_context_records/urls.py
+++ b/archaeological_context_records/urls.py
@@ -18,30 +18,41 @@
 # See the file COPYING for details.
 
 from django.conf.urls.defaults import *
+
+from ishtar_common.wizards import check_rights
 import views
 
+# be carreful: each check_rights must be relevant with ishtar_menu
+
 # forms
 urlpatterns = patterns(
     '',
     # Context records
     url(r'record_search/(?P<step>.+)?$',
-        views.record_search_wizard, name='record_search'),
+        check_rights(['view_contextrecord', 'view_own_contextrecord'])(
+            views.record_search_wizard), name='record_search'),
     url(r'record_creation/(?P<step>.+)?$',
-        views.record_creation_wizard, name='record_creation'),
+        check_rights(['add_contextrecord'])(
+            views.record_creation_wizard), name='record_creation'),
     url(r'record_modification/(?P<step>.+)?$',
-        views.record_modification_wizard, name='record_modification'),
+        check_rights(['change_contextrecord', 'change_own_contextrecord'])(
+            views.record_modification_wizard), name='record_modification'),
     url(r'record_modify/(?P<pk>.+)/$',
         views.record_modify, name='record_modify'),
     url(r'record_deletion/(?P<step>.+)?$',
-        views.record_deletion_wizard, name='record_deletion'),
+        check_rights(['change_contextrecord', 'change_own_contextrecord'])(
+            views.record_deletion_wizard), name='record_deletion'),
     url(r'record_source_creation/(?P<step>.+)?$',
-        views.record_source_creation_wizard,
+        check_rights(['change_contextrecord', 'change_own_contextrecord'])(
+            views.record_source_creation_wizard),
         name='record_source_creation'),
     url(r'record_source_modification/(?P<step>.+)?$',
-        views.record_source_modification_wizard,
+        check_rights(['change_contextrecord', 'change_own_contextrecord'])(
+            views.record_source_modification_wizard),
         name='record_source_modification'),
     url(r'record_source_deletion/(?P<step>.+)?$',
-        views.record_source_deletion_wizard,
+        check_rights(['change_contextrecord', 'change_own_contextrecord'])(
+            views.record_source_deletion_wizard),
         name='record_source_deletion'),
 )
 
diff --git a/archaeological_files/ishtar_menu.py b/archaeological_files/ishtar_menu.py
index 4458c5b8f..b120d18d1 100644
--- a/archaeological_files/ishtar_menu.py
+++ b/archaeological_files/ishtar_menu.py
@@ -19,66 +19,74 @@
 
 from django.utils.translation import ugettext_lazy as _
 
-from archaeological_operations.models import Operation
 from ishtar_common.menu_base import SectionItem, MenuItem
 
 from archaeological_operations.models import AdministrativeAct
 
 import models
 
+# be carreful: each access_controls must be relevant with check_rights in urls
+
 MENU_SECTIONS = [
-    (20, SectionItem('file_management', _(u"Archaeological file"),
-        childs=[
-                MenuItem('file_search', _(u"Search"),
-                    model=models.File,
-                    access_controls=['view_file', 'view_own_file']),
-                MenuItem('file_creation', _(u"Creation"),
-                    model=models.File,
-                    access_controls=['add_file', 'add_own_file']),
-                MenuItem('file_modification', _(u"Modification"),
-                    model=models.File,
-                    access_controls=['change_file', 'change_own_file']),
-                MenuItem('file_closing', _(u"Closing"),
-                  model=models.File,
-                  access_controls=['close_file']),
-                MenuItem('file_deletion', _(u"Deletion"),
-                    model=models.File,
-                    access_controls=['delete_file', 'delete_own_file']),
-                SectionItem('admin_act_files', _(u"Administrative act"),
-            childs=[
-                MenuItem('file_administrativeactfil_search',
-                         _(u"Search"),
-                  model=AdministrativeAct,
-                  access_controls=['change_file', 'change_own_file']),
-                MenuItem('file_administrativeactfil',
-                         _(u"Add"),
-                  model=AdministrativeAct,
-                  access_controls=['change_file', 'change_own_file']),
-                MenuItem('file_administrativeactfil_modification',
-                         _(u"Modification"),
-                  model=AdministrativeAct,
-                  access_controls=['change_file', 'change_own_file']),
-                MenuItem('file_administrativeactfil_deletion',
-                         _(u"Deletion"),
-                  model=AdministrativeAct,
-                  access_controls=['delete_file', 'delete_own_file']),
-                MenuItem('file_administrativeact_document',
-                         _(u"Documents"),
-                  model=AdministrativeAct,
-                  access_controls=['change_file', 'change_own_file']),
-                ],),
-        ]),
-    ),
-    (100, SectionItem('dashboard', _(u"Dashboard"),
-        childs=[
-                MenuItem('dashboard_main', _(u"General informations"),
-                    model=models.File,
-                    access_controls=['change_file', 'change_own_file']),
-                MenuItem('dashboard_file', _(u"Archaeological files"),
-                    model=models.File,
-                    access_controls=['change_file', 'change_own_file']),
-        ]),
-    ),
+    (20,
+     SectionItem(
+         'file_management', _(u"Archaeological file"),
+         childs=[
+             MenuItem(
+                 'file_search', _(u"Search"),
+                 model=models.File,
+                 access_controls=['view_file', 'view_own_file']),
+             MenuItem(
+                 'file_creation', _(u"Creation"),
+                 model=models.File,
+                 access_controls=['add_file', 'add_own_file']),
+             MenuItem(
+                 'file_modification', _(u"Modification"),
+                 model=models.File,
+                 access_controls=['change_file', 'change_own_file']),
+             MenuItem(
+                 'file_closing', _(u"Closing"),
+                 model=models.File,
+                 access_controls=['close_file']),
+             MenuItem(
+                 'file_deletion', _(u"Deletion"),
+                 model=models.File,
+                 access_controls=['delete_file', 'delete_own_file']),
+             SectionItem(
+                 'admin_act_files', _(u"Administrative act"),
+                 childs=[
+                     MenuItem('file_administrativeactfil_search',
+                              _(u"Search"),
+                              model=AdministrativeAct,
+                              access_controls=['change_administrativeact']),
+                     MenuItem('file_administrativeactfil',
+                              _(u"Add"),
+                              model=AdministrativeAct,
+                              access_controls=['change_administrativeact']),
+                     MenuItem('file_administrativeactfil_modification',
+                              _(u"Modification"),
+                              model=AdministrativeAct,
+                              access_controls=['change_administrativeact']),
+                     MenuItem('file_administrativeactfil_deletion',
+                              _(u"Deletion"),
+                              model=AdministrativeAct,
+                              access_controls=['change_administrativeact']),
+                     MenuItem('file_administrativeact_document',
+                              _(u"Documents"),
+                              model=AdministrativeAct,
+                              access_controls=['change_administrativeact']),
+                 ],)]),),
+    (100,
+     SectionItem(
+         'dashboard', _(u"Dashboard"),
+         childs=[MenuItem('dashboard_main', _(u"General informations"),
+                          model=models.File,
+                          access_controls=['change_file', 'change_own_file']),
+                 MenuItem('dashboard_file', _(u"Archaeological files"),
+                          model=models.File,
+                          access_controls=['change_file', 'change_own_file']),
+                 ]),
+     ),
 ]
 """
         SectionItem('dashboard', _(u"Dashboard"),
diff --git a/archaeological_files/urls.py b/archaeological_files/urls.py
index 30f50263a..1fcf71531 100644
--- a/archaeological_files/urls.py
+++ b/archaeological_files/urls.py
@@ -19,33 +19,48 @@
 
 from django.conf.urls.defaults import *
 
+from ishtar_common.wizards import check_rights
 import views
 
+# be carreful: each check_rights must be relevant with ishtar_menu
+
 # forms:
 urlpatterns = patterns(
     '',
     url(r'file_administrativeactfil_search/(?P<step>.+)?$',
-        views.file_administrativeactfile_search_wizard,
+        check_rights(['change_administrativeact'])(
+            views.file_administrativeactfile_search_wizard),
         name='file_administrativeactfile_search'),
     url(r'file_administrativeactfil/(?P<step>.+)?$',
-        views.file_administrativeactfile_wizard,
+        check_rights(['change_administrativeact'])(
+            views.file_administrativeactfile_wizard),
         name='file_administrativeactfile'),
     url(r'file_administrativeactfil_deletion/(?P<step>.+)?$',
-        views.file_administrativeactfile_deletion_wizard,
+        check_rights(['change_administrativeact'])(
+            views.file_administrativeactfile_deletion_wizard),
         name='file_administrativeactfile_deletion'),
     url(r'file_administrativeactfil_modification/(?P<step>.+)?$',
-        views.file_administrativeactfile_modification_wizard,
+        check_rights(['change_administrativeact'])(
+            views.file_administrativeactfile_modification_wizard),
         name='file_administrativeactfile_modification'),
-    url(r'file_search/(?P<step>.+)?$', views.file_search_wizard,
+    url(r'file_search/(?P<step>.+)?$',
+        check_rights(['view_file', 'view_own_file'])(
+            views.file_search_wizard),
         name='file_search'),
     url(r'file_creation/(?P<step>.+)?$',
-        views.file_creation_wizard, name='file_creation'),
+        check_rights(['add_file'])(
+            views.file_creation_wizard), name='file_creation'),
     url(r'file_modification/(?P<step>.+)?$',
-        views.file_modification_wizard, name='file_modification'),
+        check_rights(['change_file', 'change_own_file'])(
+            views.file_modification_wizard), name='file_modification'),
     url(r'file_modify/(?P<pk>.+)/$', views.file_modify, name='file_modify'),
-    url(r'file_closing/(?P<step>.+)?$', views.file_closing_wizard,
+    url(r'file_closing/(?P<step>.+)?$',
+        check_rights(['change_file'])(
+            views.file_closing_wizard),
         name='file_closing'),
-    url(r'file_deletion/(?P<step>.+)?$', views.file_deletion_wizard,
+    url(r'file_deletion/(?P<step>.+)?$',
+        check_rights(['delete_file', 'delete_own_file'])(
+            views.file_deletion_wizard),
         name='file_deletion'),
 )
 
diff --git a/archaeological_finds/ishtar_menu.py b/archaeological_finds/ishtar_menu.py
index 8034d96e7..a688adbb4 100644
--- a/archaeological_finds/ishtar_menu.py
+++ b/archaeological_finds/ishtar_menu.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python
 # -*- coding: utf-8 -*-
-# Copyright (C) 2012 Étienne Loks  <etienne.loks_AT_peacefrogsDOTnet>
+# Copyright (C) 2012-2015 Étienne Loks  <etienne.loks_AT_peacefrogsDOTnet>
 
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as
@@ -23,6 +23,8 @@ from ishtar_common.menu_base import SectionItem, MenuItem
 
 import models
 
+# be carreful: each access_controls must be relevant with check_rights in urls
+
 MENU_SECTIONS = [
     (50,
      SectionItem(
diff --git a/archaeological_finds/urls.py b/archaeological_finds/urls.py
index b16752911..29f502e15 100644
--- a/archaeological_finds/urls.py
+++ b/archaeological_finds/urls.py
@@ -19,27 +19,36 @@
 
 from django.conf.urls.defaults import *
 
+from ishtar_common.wizards import check_rights
 import views
 
+# be carreful: each check_rights must be relevant with ishtar_menu
+
 # forms
 urlpatterns = patterns(
     '',
     url(r'find_search/(?P<step>.+)?$',
-        views.find_search_wizard, name='find_search'),
+        check_rights(['view_find', 'view_own_find'])(
+            views.find_search_wizard), name='find_search'),
     url(r'find_creation/(?P<step>.+)?$',
-        views.find_creation_wizard, name='find_creation'),
+        check_rights(['add_find'])(
+            views.find_creation_wizard), name='find_creation'),
     url(r'find_modification/(?P<step>.+)?$',
-        views.find_modification_wizard, name='find_modification'),
+        check_rights(['change_find', 'change_own_find'])(
+            views.find_modification_wizard), name='find_modification'),
     url(r'find_modify/(?P<pk>.+)/$',
         views.find_modify, name='find_modify'),
     url(r'find_source_creation/(?P<step>.+)?$',
-        views.find_source_creation_wizard,
+        check_rights(['change_find', 'change_own_find'])(
+            views.find_source_creation_wizard),
         name='find_source_creation'),
     url(r'find_source_modification/(?P<step>.+)?$',
-        views.find_source_modification_wizard,
+        check_rights(['change_find', 'change_own_find'])(
+            views.find_source_modification_wizard),
         name='find_source_modification'),
     url(r'find_source_deletion/(?P<step>.+)?$',
-        views.find_source_deletion_wizard,
+        check_rights(['change_find', 'change_own_find'])(
+            views.find_source_deletion_wizard),
         name='find_source_deletion'),
 )
 
diff --git a/archaeological_operations/ishtar_menu.py b/archaeological_operations/ishtar_menu.py
index 2fffa5947..60f764ab7 100644
--- a/archaeological_operations/ishtar_menu.py
+++ b/archaeological_operations/ishtar_menu.py
@@ -24,6 +24,8 @@ from ishtar_common.menu_base import SectionItem, MenuItem
 
 import models
 
+# be carreful: each access_controls must be relevant with check_rights in urls
+
 FILES_AVAILABLE = 'archaeological_files' in settings.INSTALLED_APPS
 
 MENU_SECTIONS = [
@@ -60,8 +62,8 @@ MENU_SECTIONS = [
                     MenuItem('operation_source_search',
                              _(u"Search"),
                              model=models.OperationSource,
-                             access_controls=['change_operation',
-                                              'change_own_operation']),
+                             access_controls=['view_operation',
+                                              'view_own_operation']),
                     MenuItem('operation_source_creation',
                              _(u"Add"),
                              model=models.OperationSource,
diff --git a/archaeological_operations/urls.py b/archaeological_operations/urls.py
index cc2c6f9ac..a6c4bd7b3 100644
--- a/archaeological_operations/urls.py
+++ b/archaeological_operations/urls.py
@@ -22,35 +22,46 @@ from django.conf.urls.defaults import *
 from ishtar_common.wizards import check_rights
 import views
 
+# be carreful: each check_rights must be relevant with ishtar_menu
+
 # forms
 urlpatterns = patterns(
     '',
     url(r'operation_administrativeactop_search/(?P<step>.+)?$',
-        views.operation_administrativeactop_search_wizard,
+        check_rights(['change_administrativeact'])(
+            views.operation_administrativeactop_search_wizard),
         name='operation_administrativeactop_search'),
     url(r'operation_administrativeactop/(?P<step>.+)?$',
-        views.operation_administrativeactop_wizard,
+        check_rights(['change_administrativeact'])(
+            views.operation_administrativeactop_wizard),
         name='operation_administrativeactop'),
     url(r'operation_administrativeactop_modification/(?P<step>.+)?$',
-        views.operation_administrativeactop_modification_wizard,
+        check_rights(['change_administrativeact'])(
+            views.operation_administrativeactop_modification_wizard),
         name='operation_administrativeactop_modification'),
     url(r'operation_administrativeactop_deletion/(?P<step>.+)?$',
-        views.operation_administrativeactop_deletion_wizard,
+        check_rights(['change_administrativeact'])(
+            views.operation_administrativeactop_deletion_wizard),
         name='operation_administrativeactop_deletion'),
     url(r'operation_source_search/(?P<step>.+)?$',
-        views.operation_source_search_wizard,
+        check_rights(['view_operation', 'view_own_operation'])(
+            views.operation_source_search_wizard),
         name='operation_source_search'),
     url(r'operation_source_creation/(?P<step>.+)?$',
-        views.operation_source_creation_wizard,
+        check_rights(['change_operation', 'change_own_operation'])(
+            views.operation_source_creation_wizard),
         name='operation_source_creation'),
     url(r'operation_source_modification/(?P<step>.+)?$',
-        views.operation_source_modification_wizard,
+        check_rights(['change_operation', 'change_own_operation'])(
+            views.operation_source_modification_wizard),
         name='operation_source_modification'),
     url(r'operation_source_deletion/(?P<step>.+)?$',
-        views.operation_source_deletion_wizard,
+        check_rights(['change_operation', 'change_own_operation'])(
+            views.operation_source_deletion_wizard),
         name='operation_source_deletion'),
     url(r'operation_search/(?P<step>.+)?$',
-        views.operation_search_wizard, name='operation_search'),
+        check_rights(['view_operation', 'view_own_operation'])(
+            views.operation_search_wizard), name='operation_search'),
     url(r'operation_creation/(?P<step>.+)?$',
         check_rights(['add_operation'])(views.operation_creation_wizard),
         name='operation_creation'),
@@ -63,11 +74,14 @@ urlpatterns = patterns(
     url(r'operation_modify/(?P<pk>.+)/$',
         views.operation_modify, name='operation_modify'),
     url(r'operation_closing/(?P<step>.+)?$',
-        views.operation_closing_wizard, name='operation_closing'),
+        check_rights(['change_operation'])(
+            views.operation_closing_wizard), name='operation_closing'),
     url(r'operation_deletion/(?P<step>.+)?$',
-        views.operation_deletion_wizard, name='operation_deletion'),
+        check_rights(['change_operation', 'change_own_operation'])(
+            views.operation_deletion_wizard), name='operation_deletion'),
     url(r'administrativact_register/(?P<step>.+)?$',
-        views.administrativact_register_wizard,
+        check_rights(['view_administrativeact', 'view_own_administrativeact'])(
+            views.administrativact_register_wizard),
         name='administrativact_register'),
 )
 
diff --git a/archaeological_operations/views.py b/archaeological_operations/views.py
index ae722d2bc..d3d50d791 100644
--- a/archaeological_operations/views.py
+++ b/archaeological_operations/views.py
@@ -26,7 +26,7 @@ from django.shortcuts import render_to_response, redirect
 from django.utils.translation import ugettext_lazy as _, pgettext_lazy
 
 from ishtar_common.views import get_item, show_item, revert_item, new_item
-from ishtar_common.wizards import SearchWizard
+from ishtar_common.wizards import SearchWizard, check_rights_condition
 from ishtar_common.forms import ClosingDateFormSelection
 from ishtar_common.forms_common import AuthorFormset, TownFormset, \
     SourceDeletionForm
@@ -220,6 +220,8 @@ operation_creation_wizard = OperationWizard.as_view(
     wizard_steps,
     label=_(u"New operation"),
     condition_dict={
+        'filechoice-operation_creation':
+        check_rights_condition(['view_file']),
         'preventive-operation_creation':
         is_preventive('general-operation_creation', models.OperationType,
                       'operation_type', 'prev_excavation'),
diff --git a/archaeological_warehouse/ishtar_menu.py b/archaeological_warehouse/ishtar_menu.py
index 7cb287d63..3551fab00 100644
--- a/archaeological_warehouse/ishtar_menu.py
+++ b/archaeological_warehouse/ishtar_menu.py
@@ -22,17 +22,17 @@ from django.utils.translation import ugettext_lazy as _
 from ishtar_common.menu_base import SectionItem, MenuItem
 
 from archaeological_finds.models import Treatment
-import models
+
+# be carreful: each access_controls must be relevant with check_rights in urls
 
 
 MENU_SECTIONS = [
     (60, SectionItem('find_management', _(u"Find"),
-        childs=[
-            MenuItem('warehouse_packaging', _(u"Packaging"),
-                model=Treatment,
-                access_controls=['add_treatment', 'add_own_treatment']),
-        ])
-        ),
+     childs=[
+        MenuItem('warehouse_packaging', _(u"Packaging"),
+                 model=Treatment,
+                 access_controls=['add_treatment', 'add_own_treatment']),
+    ])),
 ]
 """
     (60, SectionItem('warehouse', _(u"Warehouse"),
diff --git a/archaeological_warehouse/urls.py b/archaeological_warehouse/urls.py
index 2ae27c279..58f594bcd 100644
--- a/archaeological_warehouse/urls.py
+++ b/archaeological_warehouse/urls.py
@@ -19,25 +19,30 @@
 
 from django.conf.urls.defaults import *
 
+# from ishtar_common.wizards import check_rights
 import views
 
+# be carreful: each check_rights must be relevant with ishtar_menu
+
 # forms
-urlpatterns = patterns('',
-       #url(r'treatment_creation/(?P<step>.+)?$',
-       #    views.treatment_creation_wizard, name='treatment_creation'),
-       url(r'warehouse_packaging/(?P<step>.+)?$',
-           views.warehouse_packaging_wizard, name='warehouse_packaging'),
+urlpatterns = patterns(
+    '',
+    # url(r'treatment_creation/(?P<step>.+)?$',
+    #    views.treatment_creation_wizard, name='treatment_creation'),
+    url(r'warehouse_packaging/(?P<step>.+)?$',
+        views.warehouse_packaging_wizard, name='warehouse_packaging'),
 )
 
-urlpatterns += patterns('archaeological_warehouse.views',
-     url(r'new-warehouse/(?P<parent_name>.+)?/$',
-           'new_warehouse', name='new-warehouse'),
-     url(r'autocomplete-warehouse/$', 'autocomplete_warehouse',
-           name='autocomplete-warehouse'),
-     url(r'new-container/(?P<parent_name>.+)?/$',
-           'new_container', name='new-container'),
-     url(r'get-container/$', 'get_container',
-           name='get-container'),
-     url(r'autocomplete-container/?$',
-           'autocomplete_container', name='autocomplete-container'),
+urlpatterns += patterns(
+    'archaeological_warehouse.views',
+    url(r'new-warehouse/(?P<parent_name>.+)?/$',
+        'new_warehouse', name='new-warehouse'),
+    url(r'autocomplete-warehouse/$', 'autocomplete_warehouse',
+        name='autocomplete-warehouse'),
+    url(r'new-container/(?P<parent_name>.+)?/$',
+        'new_container', name='new-container'),
+    url(r'get-container/$', 'get_container',
+        name='get-container'),
+    url(r'autocomplete-container/?$',
+        'autocomplete_container', name='autocomplete-container'),
 )
diff --git a/ishtar_common/ishtar_menu.py b/ishtar_common/ishtar_menu.py
index b02136841..30cba6735 100644
--- a/ishtar_common/ishtar_menu.py
+++ b/ishtar_common/ishtar_menu.py
@@ -19,78 +19,93 @@
 
 from django.utils.translation import ugettext_lazy as _
 
-from archaeological_operations.models import Operation
 from ishtar_common.menu_base import SectionItem, MenuItem
 
 import models
 
+# be carreful: each access_controls must be relevant with check_rights in urls
+
 MENU_SECTIONS = [
     (5, SectionItem('admin', _(u"Administration"),
-            childs=[
-                MenuItem('account_management', _(u"Account management"),
-                    model=models.IshtarUser,
-                    access_controls=['add_ishtaruser',]),
-                MenuItem('admin-globalvar', _(u"Global variables"),
-                    model=models.GlobalVar,
-                    access_controls=['add_globalvar',]),
-            ])
+     childs=[
+        MenuItem('account_management', _(u"Account management"),
+                 model=models.IshtarUser,
+                 access_controls=['add_ishtaruser', ]),
+        MenuItem('admin-globalvar', _(u"Global variables"),
+                 model=models.GlobalVar,
+                 access_controls=['add_globalvar', ]),
+    ])
     ),
     (10, SectionItem('administration', _(u"Directory"),
+     childs=[
+        SectionItem(
+            'person', _(u"Person"),
             childs=[
-                SectionItem('person', _(u"Person"),
-                childs=[
-                    MenuItem('person_search', _(u"Search"),
-                        model=models.Person,
-                        access_controls=['add_person', 'add_own_person']),
-                    MenuItem('person_creation', _(u"Creation"),
-                        model=models.Person,
-                        access_controls=['add_person', 'add_own_person']),
-                    MenuItem('person_modification', _(u"Modification"),
-                        model=models.Person,
-                        access_controls=['change_person', 'change_own_person']),
-                    MenuItem('person_merge', _(u"Merge"),
-                        model=models.Person,
-                        access_controls=['merge_person',]),
-                    MenuItem('person_deletion', _(u"Delete"),
-                        model=models.Person,
-                        access_controls=['change_person', 'change_own_person']),
-                    ]),
-                SectionItem('organization', _(u"Organization"),
-                childs=[
-                    MenuItem('organization_search', _(u"Search"),
-                        model=models.Organization,
-                        access_controls=['add_organization',
-                                         'add_own_organization']),
-                    MenuItem('organization_creation', _(u"Creation"),
-                        model=models.Organization,
-                        access_controls=['add_organization',
-                                         'add_own_organization']),
-                    MenuItem('organization_modification', _(u"Modification"),
-                        model=models.Organization,
-                        access_controls=['change_organization',
-                                         'change_own_organization']),
-                    MenuItem('organization_merge', _(u"Merge"),
-                        model=models.Organization,
-                        access_controls=['merge_organization',]),
-                    MenuItem('organization_deletion', _(u"Delete"),
-                        model=models.Organization,
-                        access_controls=['change_organization',
-                                         'change_own_organization']),
-                    ]),
-            ])
-    ),
-    (15, SectionItem('imports', _(u"Imports"),
+                MenuItem(
+                    'person_search', _(u"Search"),
+                    model=models.Person,
+                    access_controls=['add_person']),
+                MenuItem(
+                    'person_creation', _(u"Creation"),
+                    model=models.Person,
+                    access_controls=['add_person']),
+                MenuItem(
+                    'person_modification', _(u"Modification"),
+                    model=models.Person,
+                    access_controls=['change_person', 'change_own_person']),
+                MenuItem(
+                    'person_merge', _(u"Merge"),
+                    model=models.Person,
+                    access_controls=['merge_person']),
+                MenuItem(
+                    'person_deletion', _(u"Delete"),
+                    model=models.Person,
+                    access_controls=['change_person', 'change_own_person']),
+            ]),
+        SectionItem(
+            'organization', _(u"Organization"),
             childs=[
-                MenuItem('import-new', _(u"New import"),
-                    model=models.Import,
-                    access_controls=['change_import']),
-                MenuItem('import-list', _(u"Current imports"),
-                    model=models.Import,
-                    access_controls=['change_import']),
-                MenuItem('import-list-old', _(u"Old imports"),
-                    model=models.Import,
-                    access_controls=['change_import']),
-            ])
+                MenuItem(
+                    'organization_search', _(u"Search"),
+                    model=models.Organization,
+                    access_controls=['add_organization',
+                                     'add_own_organization']),
+                MenuItem(
+                    'organization_creation', _(u"Creation"),
+                    model=models.Organization,
+                    access_controls=['add_organization',
+                                     'add_own_organization']),
+                MenuItem(
+                    'organization_modification', _(u"Modification"),
+                    model=models.Organization,
+                    access_controls=['change_organization',
+                                     'change_own_organization']),
+                MenuItem(
+                    'organization_merge', _(u"Merge"),
+                    model=models.Organization,
+                    access_controls=['merge_organization']),
+                MenuItem(
+                    'organization_deletion', _(u"Delete"),
+                    model=models.Organization,
+                    access_controls=['change_organization',
+                                     'change_own_organization']),
+            ]),
+    ])
     ),
+    (15, SectionItem(
+        'imports', _(u"Imports"),
+        childs=[
+            MenuItem(
+                'import-new', _(u"New import"),
+                model=models.Import,
+                access_controls=['change_import']),
+            MenuItem(
+                'import-list', _(u"Current imports"),
+                model=models.Import,
+                access_controls=['change_import']),
+            MenuItem(
+                'import-list-old', _(u"Old imports"),
+                model=models.Import,
+                access_controls=['change_import']),
+        ])),
 ]
-
diff --git a/ishtar_common/urls.py b/ishtar_common/urls.py
index 70109a2f3..036494354 100644
--- a/ishtar_common/urls.py
+++ b/ishtar_common/urls.py
@@ -24,9 +24,9 @@ from django.conf.urls.static import static
 from menus import menu
 
 from ishtar_common import views
+from ishtar_common.wizards import check_rights
 
-urlpatterns, actions = [], []
-
+# be carreful: each check_rights must be relevant with ishtar_menu
 
 # forms
 urlpatterns = patterns(
@@ -35,48 +35,71 @@ urlpatterns = patterns(
     url(r'^i18n/', include('django.conf.urls.i18n')),
     # General
     url(r'person_search/(?P<step>.+)?$',
-        views.person_search_wizard, name='person_search'),
+        check_rights(['add_person'])(
+            views.person_search_wizard), name='person_search'),
     url(r'person_creation/(?P<step>.+)?$',
-        views.person_creation_wizard, name='person_creation'),
+        check_rights(['add_person'])(
+            views.person_creation_wizard), name='person_creation'),
     url(r'person_modification/(?P<step>.+)?$',
-        views.person_modification_wizard, name='person_modification'),
+        check_rights(['change_person', 'change_own_person'])(
+            views.person_modification_wizard), name='person_modification'),
     url(r'person_deletion/(?P<step>.+)?$',
-        views.person_deletion_wizard, name='person_deletion'),
+        check_rights(['change_person', 'change_own_person'])(
+            views.person_deletion_wizard), name='person_deletion'),
     url(r'^person-edit/$',
-        views.PersonCreate.as_view(), name='person_create'),
+        check_rights(['add_person'])(
+            views.PersonCreate.as_view()), name='person_create'),
     url(r'^person-edit/(?P<pk>\d+)$',
-        views.PersonEdit.as_view(), name='person_edit'),
+        check_rights(['change_person', 'change_own_person'])(
+            views.PersonEdit.as_view()), name='person_edit'),
     url(r'organization_search/(?P<step>.+)?$',
-        views.organization_search_wizard, name='organization_search'),
+        check_rights(['add_organization'])(
+            views.organization_search_wizard), name='organization_search'),
     url(r'organization_creation/(?P<step>.+)?$',
-        views.organization_creation_wizard, name='organization_creation'),
+        check_rights(['add_organization'])(
+            views.organization_creation_wizard), name='organization_creation'),
     url(r'organization_modification/(?P<step>.+)?$',
-        views.organization_modification_wizard,
+        check_rights(['change_organization', 'change_own_organization'])(
+            views.organization_modification_wizard),
         name='organization_modification'),
     url(r'organization_deletion/(?P<step>.+)?$',
-        views.organization_deletion_wizard, name='organization_deletion'),
+        check_rights(['change_organization', 'change_own_organization'])(
+            views.organization_deletion_wizard), name='organization_deletion'),
     url(r'organization-edit/$',
-        views.OrganizationCreate.as_view(), name='organization_create'),
+        check_rights(['add_organization'])(
+            views.OrganizationCreate.as_view()), name='organization_create'),
     url(r'organization-edit/(?P<pk>\d+)$',
-        views.OrganizationEdit.as_view(), name='organization_edit'),
+        check_rights(['change_organization', 'change_own_organization'])(
+            views.OrganizationEdit.as_view()), name='organization_edit'),
     url(r'organization-person-edit/$',
-        views.OrganizationPersonCreate.as_view(),
+        check_rights(['add_organization'])(
+            views.OrganizationPersonCreate.as_view()),
         name='organization_person_create'),
     url(r'organization-person-edit/(?P<pk>\d+)$',
-        views.OrganizationPersonEdit.as_view(),
+        check_rights(['change_organization', 'change_own_organization'])(
+            views.OrganizationPersonEdit.as_view()),
         name='organization_person_edit'),
     url(r'account_management/(?P<step>.+)?$',
-        views.account_management_wizard, name='account_management'),
-    url(r'^import-new/$', views.NewImportView.as_view(), name='new_import'),
-    url(r'^import-list/$', views.ImportListView.as_view(),
+        check_rights(['add_ishtaruser'])(
+            views.account_management_wizard), name='account_management'),
+    url(r'^import-new/$',
+        check_rights(['change_import'])(
+            views.NewImportView.as_view()), name='new_import'),
+    url(r'^import-list/$',
+        check_rights(['change_import'])(
+            views.ImportListView.as_view()),
         name='current_imports'),
-    url(r'^import-list-old/$', views.ImportOldListView.as_view(),
+    url(r'^import-list-old/$',
+        check_rights(['change_import'])(
+            views.ImportOldListView.as_view()),
         name='old_imports'),
     url(r'^import-delete/(?P<pk>[0-9]+)/$',
         views.ImportDeleteView.as_view(), name='import_delete'),
     url(r'^import-link-unmatched/(?P<pk>[0-9]+)/$',
         views.ImportLinkView.as_view(), name='import_link_unmatched'),
 )
+
+actions = []
 for section in menu.childs:
     for menu_item in section.childs:
         if hasattr(menu_item, 'childs'):
diff --git a/ishtar_common/wizards.py b/ishtar_common/wizards.py
index cc6107928..23469c659 100644
--- a/ishtar_common/wizards.py
+++ b/ishtar_common/wizards.py
@@ -21,7 +21,6 @@ import datetime
 # from functools import wraps
 
 from django.conf import settings
-from django.contrib.formtools.wizard.storage import get_storage
 from django.contrib.formtools.wizard.views import NamedUrlWizardView, \
     normalize_name, get_storage, StepsHelper
 from django.contrib.sites.models import Site
@@ -77,6 +76,23 @@ def check_rights(rights=[], redirect_url='/'):
     return decorator
 
 
+def check_rights_condition(rights):
+    """
+    To be used to check in wizard condition_dict
+    """
+    def func(self):
+        request = self.request
+        if request.user.ishtaruser.has_right('administrator', request.session):
+            return True
+        for right in rights:
+            print(right)
+            if request.user.ishtaruser.has_right(right, request.session):
+                return True
+        print('hop')
+        return False
+    return func
+
+
 class Wizard(NamedUrlWizardView):
     model = None
     label = ''
@@ -126,7 +142,8 @@ class Wizard(NamedUrlWizardView):
             self.request = request
             self.session = request.session
             self.prefix = self.get_prefix(*args, **kwargs)
-            self.storage = get_storage(self.storage_name, self.prefix, request,
+            self.storage = get_storage(
+                self.storage_name, self.prefix, request,
                 getattr(self, 'file_storage', None))
             self.steps = StepsHelper(self)