nonstop: check add_track permission for zone settings
authorFrédéric Péters <fpeters@0d.be>
Wed, 22 Jul 2020 15:17:53 +0000 (17:17 +0200)
committerFrédéric Péters <fpeters@0d.be>
Wed, 22 Jul 2020 15:17:53 +0000 (17:17 +0200)
nonstop/views.py

index 6a58773..bd2081d 100644 (file)
@@ -581,6 +581,7 @@ class ZoneSettings(FormView):
         return initial
 
     def form_valid(self, form):
+        assert self.request.user.has_perm('nonstop.add_track')
         zone = Nonstop.objects.get(slug=self.kwargs['slug'])
         zone_settings = zone.nonstopzonesettings_set.first()
         zone.start = form.cleaned_data['start']