Added remaining sec tests for adding subobjects to collection.

This commit is contained in:
Michael DeHaan
2013-03-23 15:08:02 -04:00
parent a1c614500c
commit 284c495c11
4 changed files with 21 additions and 22 deletions

View File

@@ -54,7 +54,7 @@ class BaseSubList(BaseList):
relationship = getattr(main, self.__class__.relationship)
if not 'disassociate' in request.DATA:
if not request.user.is_superuser or not self.__class__.parent_model.can_user_attach(request.user, main, sub, self.__class__.relationship):
if not request.user.is_superuser and not self.__class__.parent_model.can_user_attach(request.user, main, sub, self.__class__.relationship):
raise PermissionDenied()
if sub in relationship.all():
return Response(status=status.HTTP_409_CONFLICT)