Unverified Commit 5cf4f2b6 authored by Thom Wiggers's avatar Thom Wiggers 📐
Browse files

Restrict pizzas in API

parent 653943eb
......@@ -21,7 +21,11 @@ class PizzaViewset(GenericViewSet, ListModelMixin):
def list(self, request, *args, **kwargs):
if (PizzaEvent.current() or
request.user.has_perm('pizzas.change_product')):
return super().list(request, *args, **kwargs)
queryset = self.get_queryset()
if not request.user.has_perm('pizzas.order_restricted_products'):
queryset = queryset.exclude(restricted=True)
serializer = serializers.PizzaSerializer(queryset, many=True)
return Response(serializer.data)
raise PermissionDenied
@list_route()
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment