dashboard: permission check for activity view

b02c9fa7 · Kálmán Viktor · 5a759e1b · b02c9fa7
Commit b02c9fa7 authored Nov 19, 2013 by Kálmán Viktor
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 0 deletions

circle/dashboard/views.py
+3 -0

No files found.
--- a/circle/dashboard/views.py
+++ b/circle/dashboard/views.py
@@ -335,6 +335,9 @@ def mass_delete_vm(request, **kwargs):

 @require_POST
 def vm_activity(request, pk):
+    if not object.has_level(request.user, 'owner'):
+        raise PermissionDenied()
+
    latest = request.POST.get('latest')
    latest_sub = request.POST.get('latest_sub')