--- a/src/hdalab/views/profile.py Fri Sep 05 12:43:52 2014 +0200
+++ b/src/hdalab/views/profile.py Fri Sep 05 17:05:48 2014 +0200
@@ -89,8 +89,8 @@
# If a renkan id is set
rk_id = self.request.GET.get("rk_id", "")
if rk_id!="":
- rk = get_object_or_404(Renkan, rk_id=rk_id)
- if rk.owner!=self.request.user:
+ hr = get_object_or_404(HdalabRenkan.objects.select_related("renkan", "renkan__owner"), renkan__rk_id=rk_id) #.get(=rk_id)
+ if hr.renkan.owner!=self.request.user or hr.state!=HdalabRenkan.EDITION:
raise Exception("You are not allowed to edit this renkan")
form = AuthenticationForm(self.request)
@@ -466,7 +466,12 @@
class HdalabRenkanDelete(View):
def get(self, request, rk_id):
+ try:
+ hr = HdalabRenkan.objects.get(renkan__rk_id=rk_id)
+ except:
+ raise Http404('Renkan not found')
renkan_deleter(request.user, rk_id)
+ hr.delete()
if "next" in request.GET:
return redirect(request.GET["next"])
return redirect(reverse('profile_home'))