From ec36597dbc872773a53b8176b43292a3c5dffb19 Mon Sep 17 00:00:00 2001 From: Ross Date: Mon, 4 Nov 2024 12:23:34 +0000 Subject: [PATCH] . --- generic/views.py | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/generic/views.py b/generic/views.py index 5da50b98..5b3953bc 100644 --- a/generic/views.py +++ b/generic/views.py @@ -3818,8 +3818,13 @@ class UpdateQuestionMixin(RedirectMixin, RevisionMixin, UpdateView): def supervisor_overview(request, pk): supervisor = get_object_or_404(Supervisor, pk=pk) - if not request.user.supervisor == supervisor and not request.user.is_superuser: - raise PermissionDenied() + if not request.user.is_superuser: + try: + if not request.user.supervisor == supervisor: + raise PermissionDenied() + except Supervisor.RelatedObjectDoesNotExist: + raise PermissionDenied() + trainees = User.objects.filter(userprofile__supervisor=supervisor) @@ -3833,8 +3838,12 @@ def supervisor_overview(request, pk): def supervisor_trainee(request, pk, trainee_id): supervisor = get_object_or_404(Supervisor, pk=pk) - if not request.user.supervisor == supervisor and not request.user.is_superuser: - raise PermissionDenied() + if not request.user.is_superuser: + try: + if not request.user.supervisor == supervisor: + raise PermissionDenied() + except Supervisor.RelatedObjectDoesNotExist: + raise PermissionDenied() # We do this to check that the supervisor can (should) see the trainee results trainee = User.objects.get(userprofile__supervisor=supervisor, pk=trainee_id)