From d7a065c4e2439f5a28eea2be1b30788c83dd2946 Mon Sep 17 00:00:00 2001
From: Skia <skia@libskia.so>
Date: Tue, 13 Dec 2016 18:36:08 +0100
Subject: [PATCH] Update SAS rights

---
 sas/models.py                   | 12 ++++++++----
 sas/templates/sas/album.jinja   |  4 ++--
 sas/templates/sas/picture.jinja |  2 +-
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/sas/models.py b/sas/models.py
index c5513a89..c0fd48d0 100644
--- a/sas/models.py
+++ b/sas/models.py
@@ -24,11 +24,13 @@ class Picture(SithFile):
         return False
 
     def can_be_edited_by(self, user):
-        return user.is_in_group(settings.SITH_GROUP_SAS_ADMIN_ID)
+        file = SithFile.objects.filter(id=self.id).first()
+        return user.is_in_group(settings.SITH_GROUP_SAS_ADMIN_ID) or user.can_edit(file)
 
     def can_be_viewed_by(self, user):
+        file = SithFile.objects.filter(id=self.id).first()
         return self.can_be_edited_by(user) or (self.is_in_sas and self.is_moderated and
-                user.was_subscribed())
+                user.was_subscribed()) or user.can_view(file)
 
     def get_download_url(self):
         return reverse('sas:download', kwargs={'picture_id': self.id})
@@ -87,11 +89,13 @@ class Album(SithFile):
         proxy = True
 
     def can_be_edited_by(self, user):
-        return user.is_in_group(settings.SITH_GROUP_SAS_ADMIN_ID)
+        file = SithFile.objects.filter(id=self.id).first()
+        return user.is_in_group(settings.SITH_GROUP_SAS_ADMIN_ID) or user.can_edit(file)
 
     def can_be_viewed_by(self, user):
+        file = SithFile.objects.filter(id=self.id).first()
         return self.can_be_edited_by(user) or (self.is_in_sas and self.is_moderated and
-                user.was_subscribed())
+                user.was_subscribed()) or user.can_view(file)
 
     def get_absolute_url(self):
         return reverse('sas:album', kwargs={'album_id': self.id})
diff --git a/sas/templates/sas/album.jinja b/sas/templates/sas/album.jinja
index e9054357..68a0cd86 100644
--- a/sas/templates/sas/album.jinja
+++ b/sas/templates/sas/album.jinja
@@ -42,7 +42,7 @@
         {% if user.can_edit(album) %}
         <input type="checkbox" name="file_list" value="{{ a.id }}">
         {% endif %}
-        {% if a.as_album.can_be_viewed_by(user) %}
+        {% if user.can_view(a.as_album) %}
         <a href="{{ url("sas:album", album_id=a.id) }}" style="display: inline-block">
             <div class="album{% if not a.is_moderated %} not_moderated{% endif %}">
             <div>
@@ -67,7 +67,7 @@
         {% if user.can_edit(album) %}
         <input type="checkbox" name="file_list" value="{{ p.id }}">
         {% endif %}
-        {% if p.as_picture.can_be_viewed_by(user) %}
+        {% if user.can_view(p.as_picture) %}
         <div class="picture{% if not p.is_moderated %} not_moderated{% endif %}">
             <a href="{{ url("sas:picture", picture_id=p.id) }}#pict">
                 <img src="{{ p.as_picture.get_download_thumb_url() }}" alt="{{ p.get_display_name() }}" />
diff --git a/sas/templates/sas/picture.jinja b/sas/templates/sas/picture.jinja
index 685d0383..0b37b09f 100644
--- a/sas/templates/sas/picture.jinja
+++ b/sas/templates/sas/picture.jinja
@@ -62,7 +62,7 @@
             {% for r in picture.people.all() %}
             <li>
                 <a href="{{ r.user.get_absolute_url() }}">{{ r.user.get_short_name() }}</a>
-                {% if user == r.user or user.is_in_group(settings.SITH_GROUP_SAS_ADMIN_ID) %}
+                {% if user == r.user or user.can_edit(picture) %}
                 <a href="?remove_user={{ r.user.id }}">{% trans %}Delete{% endtrans %}</a>
                 {% endif %}
             </li>