Solo admins y execs pueden crear, cambio en la vista para que no salg…

…a editar
Metronus · Jun 27, 2017 · d7fb751 · d7fb751
1 parent f1a4808
commit d7fb751
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 7 deletions.
diff --git a/Metronus-Project/metronus/templates/employee/employee_view.html b/Metronus-Project/metronus/templates/employee/employee_view.html
@@ -54,11 +54,13 @@ <h3 class="name_title">{{employee.user.first_name}}</h3>
 
             <span>{% trans 'registryDate' %}: {{employee.registryDate}}</span>
           </li>
-          <li style="text-align: center">
-            <span>
-              <a href="{% url 'employee_edit' employee.user.username %}" type="button" class="btn btn-primary">{% trans 'update' %}</a>
-            </span>
-          </li>
+          {% if actor_is_executive or actor_is_admin %}
+            <li style="text-align: center">
+              <span>
+                <a href="{% url 'employee_edit' employee.user.username %}" type="button" class="btn btn-primary">{% trans 'update' %}</a>
+              </span>
+            </li>
+          {% endif %}
         </ul>
       </div>
     </div>

diff --git a/Metronus-Project/metronus_app/controllers/employeeController.py b/Metronus-Project/metronus_app/controllers/employeeController.py
@@ -48,7 +48,7 @@ def create(request):
     """
 
     # Check that the user is logged in and it's an administrator
-    admin = get_authorized_or_403(request)
+    admin = get_admin_executive_or_403(request)
 
     # If it's a GET request, return an empty form
     if request.method == "GET":
@@ -129,7 +129,7 @@ def create_async(request):
     """
 
     # Check that the user is logged in and it's an administrator
-    admin = get_authorized_or_403(request)
+    admin = get_admin_executive_or_403(request)
     errors = []
     data = {
         'success': True