Protect stats from other users

This commit is contained in:
Antoine Bartuccio 2017-03-28 01:03:31 +02:00
parent dfd465c7f9
commit 63506b1506

View File

@ -262,6 +262,14 @@ class UserStatsView(UserTabsMixin, CanViewMixin, DetailView):
template_name = "core/user_stats.jinja"
current_tab = 'stats'
def dispatch(self, request, *arg, **kwargs):
profile = self.get_object()
if (profile != request.user and not request.user.is_root):
raise PermissionDenied
return super(UserStatsView, self).dispatch(request, *arg, **kwargs)
def get_context_data(self, **kwargs):
kwargs = super(UserStatsView, self).get_context_data(**kwargs)
from counter.models import Counter, Product, Selling