Verified Commit 1a93780a authored by Sébastiaan Versteeg's avatar Sébastiaan Versteeg
Browse files

Restrict changing registration to users with change registration perms

parent 11fc3db3
...@@ -197,7 +197,9 @@ class RegistrationViewSet(GenericViewSet, RetrieveModelMixin, ...@@ -197,7 +197,9 @@ class RegistrationViewSet(GenericViewSet, RetrieveModelMixin,
def perform_update(self, serializer): def perform_update(self, serializer):
registration = serializer.instance registration = serializer.instance
if services.is_organiser(self.request.member, registration.event): member = self.request.member
if (member and member.has_perm('events.change_registration') and
services.is_organiser(member, registration.event)):
services.update_registration_by_organiser( services.update_registration_by_organiser(
registration, registration,
self.request.member, self.request.member,
......
...@@ -71,7 +71,7 @@ def is_organiser(member, event): ...@@ -71,7 +71,7 @@ def is_organiser(member, event):
if member.is_superuser or member.has_perm("events.override_organiser"): if member.is_superuser or member.has_perm("events.override_organiser"):
return True return True
if event and member.has_perm('events.change_event'): if event:
return member.get_member_groups().filter( return member.get_member_groups().filter(
pk=event.organiser.pk).count() != 0 pk=event.organiser.pk).count() != 0
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment