Fix course edit perms

8 years ago · 16a0c1676b
parent 9de5feb54d
commit 16a0c1676b
1 changed files with 2 additions and 0 deletions
--- a/apps/course/views.py
+++ b/apps/course/views.py
@ -164,6 +164,8 @@ class CourseEditView(TemplateView):
            self.object = drafts.last()
        else:
            self.object = Course.objects.create()
+        if request.user != self.object.author and request.user.role not in [User.ADMIN_ROLE, User.AUTHOR_ROLE]:
+            raise Http404
        return super().get(request)

    def get_context_data(self):