Adapt menus and urls for right management - check_rights_condition for filtering wizard steps

2 files changed, 20 insertions, 7 deletions

diff --git a/archaeological_context_records/ishtar_menu.py b/archaeological_context_records/ishtar_menu.py
index 49f92ad89..826f99b0f 100644
--- a/archaeological_context_records/ishtar_menu.py
+++ b/archaeological_context_records/ishtar_menu.py
@@ -23,6 +23,8 @@ from ishtar_common.menu_base import SectionItem, MenuItem
 
 import models
 
+# be carreful: each access_controls must be relevant with check_rights in urls
+
 MENU_SECTIONS = [
     (40, SectionItem('record_management', _(u"Context record"),
      childs=[MenuItem('record_search', _(u"Search"),
diff --git a/archaeological_context_records/urls.py b/archaeological_context_records/urls.py
index 098542fa0..7487c39c5 100644
--- a/archaeological_context_records/urls.py
+++ b/archaeological_context_records/urls.py
@@ -18,30 +18,41 @@
 # See the file COPYING for details.
 
 from django.conf.urls.defaults import *
+
+from ishtar_common.wizards import check_rights
 import views
 
+# be carreful: each check_rights must be relevant with ishtar_menu
+
 # forms
 urlpatterns = patterns(
     '',
     # Context records
     url(r'record_search/(?P<step>.+)?$',
-        views.record_search_wizard, name='record_search'),
+        check_rights(['view_contextrecord', 'view_own_contextrecord'])(
+            views.record_search_wizard), name='record_search'),
     url(r'record_creation/(?P<step>.+)?$',
-        views.record_creation_wizard, name='record_creation'),
+        check_rights(['add_contextrecord'])(
+            views.record_creation_wizard), name='record_creation'),
     url(r'record_modification/(?P<step>.+)?$',
-        views.record_modification_wizard, name='record_modification'),
+        check_rights(['change_contextrecord', 'change_own_contextrecord'])(
+            views.record_modification_wizard), name='record_modification'),
     url(r'record_modify/(?P<pk>.+)/$',
         views.record_modify, name='record_modify'),
     url(r'record_deletion/(?P<step>.+)?$',
-        views.record_deletion_wizard, name='record_deletion'),
+        check_rights(['change_contextrecord', 'change_own_contextrecord'])(
+            views.record_deletion_wizard), name='record_deletion'),
     url(r'record_source_creation/(?P<step>.+)?$',
-        views.record_source_creation_wizard,
+        check_rights(['change_contextrecord', 'change_own_contextrecord'])(
+            views.record_source_creation_wizard),
         name='record_source_creation'),
     url(r'record_source_modification/(?P<step>.+)?$',
-        views.record_source_modification_wizard,
+        check_rights(['change_contextrecord', 'change_own_contextrecord'])(
+            views.record_source_modification_wizard),
         name='record_source_modification'),
     url(r'record_source_deletion/(?P<step>.+)?$',
-        views.record_source_deletion_wizard,
+        check_rights(['change_contextrecord', 'change_own_contextrecord'])(
+            views.record_source_deletion_wizard),
         name='record_source_deletion'),
 )