Haldis/haldis
5
0
Fork 0
Code Issues 39 Pull requests Projects Releases Packages Wiki Activity

Check if user is allowed to edit

Browse source
This commit is contained in:
Feliciaan De Palmenaer 2015-06-04 21:36:57 +02:00
parent 333a7ec5ec
commit 3d5f6ef1ae
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/views/order.py
View file

@ -53,6 +53,8 @@ def order(id, form=None):
@login_required @login_required
def order_edit(id): def order_edit(id):
order = Order.query.filter(Order.id == id).first() order = Order.query.filter(Order.id == id).first()
if current_user.id is not order.courrier_id and not current_user.is_admin():
abort(401)
if order is None: if order is None:
abort(404) abort(404)
orderForm = OrderForm(obj=order) orderForm = OrderForm(obj=order)