Changeset f7dd5e7 for remit/vouchers

Timestamp:

Mar 29, 2010, 3:22:55 AM (14 years ago)

Author:

Alex Dehnert <adehnert@…>

Branches:

master, client

Children:

0a5a003

Parents:

ef500c1

git-author:

Alex Dehnert <adehnert@…> (03/29/10 03:22:55)

git-committer:

Alex Dehnert <adehnert@…> (03/29/10 03:22:55)

Message:

Let voucher recipients see requests as well

File:

• remit/vouchers/views.py (modified) (4 diffs)

remit/vouchers/views.py

@@ -2 +2 @@
 from vouchers.models import ReimbursementRequest, Documentation
 from finance_core.models import BudgetTerm, BudgetArea
+from util.shortcuts import get_403_response
 
 from django.contrib.auth.decorators import user_passes_test
@@ -168 +169 @@
 def review_request(http_request, object_id):
     request_obj = get_object_or_404(ReimbursementRequest, pk=object_id)
+    user = http_request.user
+    pagename = 'request_reimbursement'
     new = False
     if 'new' in http_request.REQUEST:
@@ -174 +177 @@
         else:
             new = False
+
+    if (user.has_perm('vouchers.view_requests') or
+        user.username == request_obj.submitter or
+        user.email.upper() == request_obj.check_to_email.upper()
+        ):
+        pass
+    else:
+        return get_403_response(http_request, errmsg="You do not have permission to access this reimbursement request. You can only view requests you submitted or are the recipient for, unless you have general viewing permissions.", pagename=pagename, )
 
     # DOCUMENTATION #
@@ -247 +258 @@
             approve_form = VoucherizeForm(initial=initial)
 
-    # Display the content
-    if not (http_request.user.has_perm('vouchers.view_requests')
-        or http_request.user.username == request_obj.submitter):
-        # I'd probably use a 403, but that requires like writing
-        # a new template and stuff
-        # So I'm going to call this "don't leak information"
-        # and let it be
-        raise Http404
     context = {
         'rr':request_obj,
-        'pagename':'request_reimbursement',
+        'pagename':pagename,
         'new': new,
         'doc_form': doc_upload_form,