From d7bf199f859ddaba4ba4ea6b3b20025294601594 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Fr=C3=A9d=C3=A9ric=20P=C3=A9ters?= <fpeters@0d.be>
Date: Wed, 22 Jul 2020 17:17:53 +0200
Subject: [PATCH] nonstop: check add_track permission for zone settings

---
 nonstop/views.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nonstop/views.py b/nonstop/views.py
index 6a58773..bd2081d 100644
--- a/nonstop/views.py
+++ b/nonstop/views.py
@@ -581,6 +581,7 @@ class ZoneSettings(FormView):
         return initial
 
     def form_valid(self, form):
+        assert self.request.user.has_perm('nonstop.add_track')
         zone = Nonstop.objects.get(slug=self.kwargs['slug'])
         zone_settings = zone.nonstopzonesettings_set.first()
         zone.start = form.cleaned_data['start']
-- 
2.39.2