Unverified Commit e97ba8a7 authored by Joost Rijneveld's avatar Joost Rijneveld
Browse files

Clarify 'view' permission

parent 8b0c088a
......@@ -180,6 +180,8 @@ class RegistrationSerializer(serializers.ModelSerializer):
'_queue_position')
def _has_view_permission(self, instance):
# We dont have an explicit viewing permission model, so we rely on the
# 'change' permission (Django provides add/change/delete by default)
return (self.context['request'].user.has_perm('events.change_event')
or instance.member.user == self.context['request'].user)
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment