diff options
| -rw-r--r-- | mediagoblin/edit/views.py | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/mediagoblin/edit/views.py b/mediagoblin/edit/views.py index 050ece4e..e5dccc81 100644 --- a/mediagoblin/edit/views.py +++ b/mediagoblin/edit/views.py @@ -5,9 +5,22 @@ from webob import Response, exc from mediagoblin.edit import forms from mediagoblin.decorators import require_active_login, get_media_entry_by_id + +def may_edit_media(request, media): + """Check, if the request's user may edit the media details""" + if media['uploader'] == request.user['_id']: + return True + if request.user['is_admin']: + return True + return False + + @get_media_entry_by_id @require_active_login def edit_media(request, media): + if not may_edit_media(request, media): + return exc.HTTPForbidden() + form = forms.EditForm(request.POST, title = media['title'], slug = media['slug'], |