diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 77102c914dc876f0e5c4c81e869f9cdf34eaa74b..f4ef5c345da19b7613f5bf9aa9ac6feda9a9f01c 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -51,6 +51,7 @@ Changed Fixed ~~~~~ +* Persons could not be edited by non-superusers with global person editing permission. * GraphQL mutations did not return errors in case of exceptions. * Make email field unique over all persons. * Third-party login buttons now directly open external login page. diff --git a/aleksis/core/forms.py b/aleksis/core/forms.py index 49f8cc3693da414a7552aa6837201d9ab98e66ef..359ec8bede87d872a6de0cf8929022df3fa08b64 100644 --- a/aleksis/core/forms.py +++ b/aleksis/core/forms.py @@ -113,6 +113,7 @@ class PersonForm(ExtensibleForm): if ( request and self.instance + and not request.user.has_perm("core.change_person") and not request.user.has_perm("core.change_person", self.instance) ): # Disable non-editable fields