diff --git a/generic/views.py b/generic/views.py index 5da50b98..5b3953bc 100644 --- a/generic/views.py +++ b/generic/views.py @@ -3818,8 +3818,13 @@ class UpdateQuestionMixin(RedirectMixin, RevisionMixin, UpdateView): def supervisor_overview(request, pk): supervisor = get_object_or_404(Supervisor, pk=pk) - if not request.user.supervisor == supervisor and not request.user.is_superuser: - raise PermissionDenied() + if not request.user.is_superuser: + try: + if not request.user.supervisor == supervisor: + raise PermissionDenied() + except Supervisor.RelatedObjectDoesNotExist: + raise PermissionDenied() + trainees = User.objects.filter(userprofile__supervisor=supervisor) @@ -3833,8 +3838,12 @@ def supervisor_overview(request, pk): def supervisor_trainee(request, pk, trainee_id): supervisor = get_object_or_404(Supervisor, pk=pk) - if not request.user.supervisor == supervisor and not request.user.is_superuser: - raise PermissionDenied() + if not request.user.is_superuser: + try: + if not request.user.supervisor == supervisor: + raise PermissionDenied() + except Supervisor.RelatedObjectDoesNotExist: + raise PermissionDenied() # We do this to check that the supervisor can (should) see the trainee results trainee = User.objects.get(userprofile__supervisor=supervisor, pk=trainee_id)