From b09738e9431eff365140628e6caf640331d71f5b Mon Sep 17 00:00:00 2001
From: Michael Bauer <michael-bauer@posteo.de>
Date: Tue, 5 Nov 2024 14:13:04 +0100
Subject: [PATCH] Adapt full_register_for_group-view's permissions for several
groups
---
aleksis/apps/alsijil/views.py | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/aleksis/apps/alsijil/views.py b/aleksis/apps/alsijil/views.py
index ea8100a29..bba56d025 100644
--- a/aleksis/apps/alsijil/views.py
+++ b/aleksis/apps/alsijil/views.py
@@ -39,15 +39,17 @@ from .tables import (
from .tasks import generate_full_register_printout
-@permission_required(
- "alsijil.view_full_register_rule", fn=objectgetter_optional(Group, None, False)
-)
def full_register_for_group(request: HttpRequest, ids: str) -> HttpResponse:
"""Show a configurable register printout as PDF for a group."""
ids = [int(id_) for id_ in ids.split("/")]
- groups = [get_object_or_404(Group, pk=id_) for id_ in ids]
+ groups = []
+ for id_ in ids:
+ group = get_object_or_404(Group, pk=id_)
+ if not request.user.has_perm("alsijil.view_full_register_rule", group):
+ raise PermissionDenied()
+ groups.append(group)
file_object = PDFFile.objects.create()
if has_person(request):
--
GitLab