diff options
Diffstat (limited to 'ishtar_common/views.py')
| -rw-r--r-- | ishtar_common/views.py | 20 |
1 files changed, 10 insertions, 10 deletions
diff --git a/ishtar_common/views.py b/ishtar_common/views.py index b3f062c8d..21b563bfc 100644 --- a/ishtar_common/views.py +++ b/ishtar_common/views.py @@ -3521,17 +3521,17 @@ class GeoCreateView(GeoFormMixin, CreateView): obj = model.objects.get(pk=self.kwargs.get("source_pk")) except model.DoesNotExist: raise Http404() + + # check permission to add and view attached item + attached_meta = model._meta + perm_attached = f"{attached_meta.app_label}.view_{attached_meta.model_name}" + perm_own_attached = f"{attached_meta.app_label}.view_own_{attached_meta.model_name}" if not ishtaruser.has_permission( - "ishtar_common.add_geovectordata"): - # -> add_own_geovectordata - # check permission to view attached item - meta = model._meta - perm = f"{meta.app_label}.view_{meta.model_name}" - perm_own = f"{meta.app_label}.view_own_{meta.model_name}" - if not ishtaruser.has_permission(perm) \ - and not ishtaruser.has_permission(perm_own, obj=obj): - # check permission to view own attached item - raise Http404() + "ishtar_common.add_geovectordata") or ( + not ishtaruser.has_permission(perm_attached) + and not ishtaruser.has_permission(perm_own_attached, obj=obj)): + # check permission to view own attached item + raise Http404() kwargs["main_items_fields"] = {} for k in models.GeoVectorData.RELATED_MODELS: kwargs["main_items_fields"][k] = [] |