klmp200/Sith
1
0
Fork 0
mirror of https://github.com/ae-utbm/sith.git synced 2024-11-25 02:24:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix permissions on sellings and refillings

Browse Source
This commit is contained in:
Skia 2016-08-29 16:07:14 +02:00
parent 3667a12174
commit 3305a19f44
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
counter/models.py
View File

@ -135,6 +135,9 @@ class Counter(models.Model):
return reverse('counter:details', kwargs={'counter_id': self.id}) return reverse('counter:details', kwargs={'counter_id': self.id})
def is_owned_by(self, user): def is_owned_by(self, user):
mem = self.club.get_membership_for(user)
if mem and mem.role >= 7:
return True
return user.is_in_group(settings.SITH_GROUPS['counter-admin']['name']) return user.is_in_group(settings.SITH_GROUPS['counter-admin']['name'])
def can_be_viewed_by(self, user): def can_be_viewed_by(self, user):
@ -211,10 +214,7 @@ class Refilling(models.Model):
return "Refilling: %.2f for %s" % (self.amount, self.customer.user.get_display_name()) return "Refilling: %.2f for %s" % (self.amount, self.customer.user.get_display_name())
def is_owned_by(self, user): def is_owned_by(self, user):
return user.can_edit(self.counter) and self.payment_method != "CARD" return user.is_owner(self.counter) and self.payment_method != "CARD"
# def get_absolute_url(self):
# return reverse('counter:details', kwargs={'counter_id': self.id})
def delete(self, *args, **kwargs): def delete(self, *args, **kwargs):
self.customer.amount -= self.amount self.customer.amount -= self.amount
@ -256,7 +256,7 @@ class Selling(models.Model):
self.quantity*self.unit_price, self.customer.user.get_display_name()) self.quantity*self.unit_price, self.customer.user.get_display_name())
def is_owned_by(self, user): def is_owned_by(self, user):
return user.can_edit(self.counter) and self.payment_method != "CARD" return user.is_owner(self.counter) and self.payment_method != "CARD"
def delete(self, *args, **kwargs): def delete(self, *args, **kwargs):
self.customer.amount += self.quantity * self.unit_price self.customer.amount += self.quantity * self.unit_price