diff --git a/re2o/utils.py b/re2o/utils.py index c7d61ef6..fa8753a5 100644 --- a/re2o/utils.py +++ b/re2o/utils.py @@ -79,12 +79,12 @@ def can_edit(model, *instance_id): instances = {} for i in instance_id: try: - instances[i] = model.objects.get(pk=i) + instances[i] = model.objects.get(pk=kwargs[i]) except model.DoesNotExist: messages.error(request, u"Entrée inexistante") return redirect(reverse('users:index')) kwargs['instances'] = instances - can = all(model.can_edit(request, instances[i]) for i in instances) + can = all(model.can_edit(instances[i], request.user) for i in instances) if not can: messages.error(request, "Vous ne pouvez pas accéder à ce menu") return redirect(reverse('users:profil', diff --git a/users/views.py b/users/views.py index def886d1..7fbc78a2 100644 --- a/users/views.py +++ b/users/views.py @@ -92,7 +92,7 @@ from machines.models import Machine from preferences.models import OptionalUser, GeneralOption from re2o.views import form -from re2o.utils import all_has_access, SortTable, can_create +from re2o.utils import all_has_access, SortTable, can_create, can_edit def password_change_action(u_form, user, request, req=False): """ Fonction qui effectue le changeemnt de mdp bdd""" @@ -203,7 +203,8 @@ def select_user_edit_form(request, user): @login_required -def edit_info(request, userid): +@can_edit(User, 'userid') +def edit_info(request, userid, **kwargs): """ Edite un utilisateur à partir de son id, si l'id est différent de request.user, vérifie la possession du droit cableur """