Skip to content

Commit 8cb426a

Browse files
committed
Correctly check for permissions on user owned petitions for transferring petitions
1 parent 24002a0 commit 8cb426a

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

pytition/petition/views.py

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1623,6 +1623,9 @@ def transfer_petition(request, petition_id):
16231623
messages.error(request, _("You don't have the permission to transfer a petition from Organization '{}'"
16241624
.format(petition.owner)))
16251625
return redirect("org_dashboard", petition.owner)
1626+
elif petition.owner_type == "user" and petition.user != pytitionuser:
1627+
messages.error(request, _("You don't have the permission to transfer this petition"))
1628+
return redirect("user_dashboard")
16261629

16271630
if petition.owner_type == "org":
16281631
ctx['base_template'] = 'petition/org_base.html'

0 commit comments

Comments
 (0)