🐛 new permissions: fix permission_check for action (refs #6126)

1 files changed, 7 insertions, 14 deletions

diff --git a/archaeological_files/views.py b/archaeological_files/views.py
index 0d3f978b5..5a8ce1975 100644
--- a/archaeological_files/views.py
+++ b/archaeological_files/views.py
@@ -49,6 +49,7 @@ from archaeological_files.wizards import (
     FileEditAdministrativeActWizard,
 )
 from ishtar_common.views import IshtarMixin, LoginRequiredMixin
+from ishtar_common.views_item import get_autocomplete_query
 from archaeological_operations.wizards import OperationWizard
 from archaeological_operations.views import operation_creation_wizard, get_parcel_modify
 
@@ -62,18 +63,10 @@ RE_YEAR_INDEX = re.compile(r"([1-2][0-9]{3})-([0-9]+)")  # eg.: 2014-123
 
 
 def autocomplete_file(request):
-    ishtaruser = getattr(request.user, "ishtaruser", None)
-    if not ishtaruser:
-        return HttpResponse(content_type="text/plain")
-    if (
-        not ishtaruser.has_permission("archaeological_files.view_file")
-        and not ishtaruser.has_permission("archaeological_files.view_own_file")
-    ):
-        return HttpResponse(content_type="text/plain")
-    if not request.GET.get("term"):
+    query = get_autocomplete_query(request, "archaeological_files", "file")
+    if query is None:
         return HttpResponse(content_type="text/plain")
     q = request.GET.get("term")
-    query = Q()
     for q in q.split(" "):
         extra = (
             Q(internal_reference__icontains=q)
@@ -538,14 +531,14 @@ class PreventiveEditView(IshtarMixin, LoginRequiredMixin, MixFormFormsetUpdateVi
     def get_form_kwargs(self):
         kwargs = super(PreventiveEditView, self).get_form_kwargs()
         try:
-            file = models.File.objects.get(pk=self.kwargs.get("pk"))
+            file_obj = models.File.objects.get(pk=self.kwargs.get("pk"))
         except models.Document.DoesNotExist:
             raise Http404()
-        if not check_permission(self.request, "file/edit-preventive/", file.pk):
+        if not check_permission(self.request, "archaeological_files.change_file", file_obj):
             raise Http404()
         initial = {}
         for k in list(self.form_class.base_fields.keys()):
-            value = getattr(file, k)
+            value = getattr(file_obj, k)
             if hasattr(value, "all"):
                 value = ",".join([str(v.pk) for v in value.all()])
             if hasattr(value, "pk"):
@@ -553,7 +546,7 @@ class PreventiveEditView(IshtarMixin, LoginRequiredMixin, MixFormFormsetUpdateVi
             initial[k] = value
         kwargs["initial"] = initial
         kwargs["user"] = self.request.user
-        self.file = file
+        self.file = file_obj
         return kwargs
 
     def get_context_data(self, **kwargs):