Merge branch 'sli' into 'master'

Only club members can view counter's stats

N'importe qui peut accéder aux tops 100, c'est pas très cool de voir ce que dépensent les autres…

See merge request !9

core/models.py

@@ -423,6 +423,14 @@ class AnonymousUser(AuthAnonymousUser):
     def is_root(self):
         return False
 
+    @property
+    def is_board_member(self):
+        return False
+
+    @property
+    def is_launderette_manager(self):
+        return False
+
     def is_in_group(self, group_name):
         """
         The anonymous user is only the public group

counter/views.py

@@ -4,6 +4,7 @@ from django.views.generic.edit import UpdateView, CreateView, DeleteView, Proces
 from django.forms.models import modelform_factory
 from django.forms import CheckboxSelectMultiple
 from django.core.urlresolvers import reverse_lazy
+from django.core.exceptions import PermissionDenied
 from django.http import HttpResponseRedirect
 from django.utils import timezone
 from django import forms
@@ -719,7 +720,7 @@ class CounterActivityView(DetailView):
     pk_url_kwarg = "counter_id"
     template_name = 'counter/activity.jinja'
 
-class CounterStatView(DetailView):
+class CounterStatView(DetailView, CanEditMixin):
     """
     Show the bar stats
     """
@@ -748,6 +749,16 @@ class CounterStatView(DetailView):
                 ).exclude(selling_sum=None).order_by('-selling_sum').all()[:100]
         return kwargs
 
+    def dispatch(self, request, *args, **kwargs):
+        try:
+            return super(CounterStatView, self).dispatch(request, *args, **kwargs)
+        except:
+            if (request.user.is_root
+                or request.user.is_board_member
+                or self.object.is_owned_by(request.user)):
+                return super(CanEditMixin, self).dispatch(request, *args, **kwargs)
+        raise PermissionDenied
+
 
 class CashSummaryListView(CanEditPropMixin, CounterTabsMixin, ListView):
     """Display a list of cash summaries"""