From ed6d2a764fcc76a0feba1c586acb9afddbecd16b Mon Sep 17 00:00:00 2001 From: Étienne Loks Date: Tue, 12 Nov 2024 17:27:25 +0100 Subject: ♻️ clean all "add_own" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ishtar_common/views.py | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) (limited to 'ishtar_common/views.py') diff --git a/ishtar_common/views.py b/ishtar_common/views.py index b3f062c8d..21b563bfc 100644 --- a/ishtar_common/views.py +++ b/ishtar_common/views.py @@ -3521,17 +3521,17 @@ class GeoCreateView(GeoFormMixin, CreateView): obj = model.objects.get(pk=self.kwargs.get("source_pk")) except model.DoesNotExist: raise Http404() + + # check permission to add and view attached item + attached_meta = model._meta + perm_attached = f"{attached_meta.app_label}.view_{attached_meta.model_name}" + perm_own_attached = f"{attached_meta.app_label}.view_own_{attached_meta.model_name}" if not ishtaruser.has_permission( - "ishtar_common.add_geovectordata"): - # -> add_own_geovectordata - # check permission to view attached item - meta = model._meta - perm = f"{meta.app_label}.view_{meta.model_name}" - perm_own = f"{meta.app_label}.view_own_{meta.model_name}" - if not ishtaruser.has_permission(perm) \ - and not ishtaruser.has_permission(perm_own, obj=obj): - # check permission to view own attached item - raise Http404() + "ishtar_common.add_geovectordata") or ( + not ishtaruser.has_permission(perm_attached) + and not ishtaruser.has_permission(perm_own_attached, obj=obj)): + # check permission to view own attached item + raise Http404() kwargs["main_items_fields"] = {} for k in models.GeoVectorData.RELATED_MODELS: kwargs["main_items_fields"][k] = [] -- cgit v1.2.3