Horizontal Privilege scalation - Download certificates without privs

[xkill]

Hi,
If you create staff users on Django. Even if they don't have enough privileges to access to the CAs, it's possible to download the CA Certs in PEM format, for example through this URL:

• /admin/django_ca/certificateauthority/1/download/?format=PEM

Steps to replicate

1. Create a django project and add django-ca.
2. Add django.admin and synchronize the database.
3. Create the initial CA and superuser
4. Login onto the admin portal as admin
5. Create a user and set as "staff"
6. Login with this user. It won't have enough privs to access to anything by default. But...
7. Open the following URL:

• /admin/django_ca/certificateauthority/1/download/?format=PEM
  The Certificate of the CA will be downloaded.

[mathiasertl]

Thanks for the report, I will look into this!