From 88359ac26f56f3c6dae232bb9af529b9a35c758e Mon Sep 17 00:00:00 2001
From: Étienne Loks <etienne.loks@iggdrasil.net>
Date: Wed, 29 Mar 2017 19:42:02 +0200
Subject: Access control: collaborators are included in get_own_query for
 operations, context records and finds (refs #3196)

---
 archaeological_operations/models.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'archaeological_operations')

diff --git a/archaeological_operations/models.py b/archaeological_operations/models.py
index 782f9cf35..13997a632 100644
--- a/archaeological_operations/models.py
+++ b/archaeological_operations/models.py
@@ -572,8 +572,10 @@ class Operation(ClosedItem, BaseHistorizedItem, ImageModel, OwnPerms,
 
     @classmethod
     def get_query_owns(cls, user):
-        return (Q(in_charge=user.ishtaruser.person) |\
-            Q(scientist=user.ishtaruser.person) |\
+        return (
+            Q(in_charge=user.ishtaruser.person) |
+            Q(scientist=user.ishtaruser.person) |
+            Q(collaborators__pk=user.ishtaruser.person.pk) |
             Q(history_creator=user)) & Q(end_date__isnull=True)
 
     def is_active(self):
-- 
cgit v1.2.3