[enh] moderation related pages are only accessible to superuser

submission/urls.py

@@ -1,5 +1,6 @@
 from django.conf.urls.defaults import patterns, url
 from django.core.urlresolvers import reverse
+from django.contrib.auth.decorators import user_passes_test
 
 from django.forms.models import modelform_factory
 from django.views.generic import CreateView, ListView
@@ -17,7 +18,7 @@ def get_success_url(self):
 
 urlpatterns = patterns('submission.views',
     url(r'^$', ArtisteCreateView.as_view(), name='submit'),
-    url(r'^moderation/$', ListView.as_view(queryset=Artiste.objects.filter(published=None), template_name="artistes/moderation.html"), name='moderation'),
+    url(r'^moderation/$', user_passes_test(lambda u: u.is_superuser)(ListView.as_view(queryset=Artiste.objects.filter(published=None), template_name="artistes/moderation.html")), name='moderation'),
     url(r'^moderation/accept/(?P<pk>[0-9]+)/$', 'accept', name='accept'),
     url(r'^moderation/reject/(?P<pk>[0-9]+)/$', 'reject', name='reject'),
 )

submission/views.py

@@ -1,10 +1,13 @@
 from artistes.models import Artiste
 from django.shortcuts import redirect
+from django.contrib.auth.decorators import user_passes_test
 
+@user_passes_test(lambda u: u.is_superuser)
 def accept(request, pk):
     Artiste.objects.filter(pk=pk).update(published=True)
     return redirect('moderation')
 
+@user_passes_test(lambda u: u.is_superuser)
 def reject(request, pk):
     Artiste.objects.filter(pk=pk).update(published=False)
     return redirect('moderation')