permission fix

8 years ago · c1fdd7e47a
parent c0e0ca66eb
commit c1fdd7e47a
1 changed files with 3 additions and 3 deletions
--- a/apps/course/views.py
+++ b/apps/course/views.py
@ -289,9 +289,9 @@ class LessonView(DetailView):

    def get(self, request, *args, **kwargs):
        response = super().get(request, *args, **kwargs)
-        if (self.object.course.status != Course.PUBLISHED and
-                (request.user.role < User.AUTHOR_ROLE or
-                 self.object.course.author != request.user)):
+        if (self.object.course.status != Course.PUBLISHED and not
+                (request.user.role == User.ADMIN_ROLE or
+                 self.object.course.author == request.user)):
            raise Http404
        return response