Check user's authorisation when loading entries by ID.

1 files changed, 8 insertions, 2 deletions

diff --git a/app/views/consts.py b/app/views/consts.py
index 20b3db1..0dcec57 100644
--- a/app/views/consts.py
+++ b/app/views/consts.py
@@ -1,12 +1,15 @@
 from . import Blueprint, db, \
         current_user, login_required, \
-        templated, redirect, request
+        assert_authorisation, templated, redirect, request
 
 from ..model import Category, ConstExpense
 from ..forms import ConstForm, today
 
 import datetime
 from sqlalchemy import sql
+from functools import partial
+
+assert_authorisation = partial(assert_authorisation, ConstExpense.get)
 
 mod = Blueprint('consts', __name__)
 
@@ -53,18 +56,20 @@ def list ():
 
 @mod.route('/<int:id>')
 @login_required
+@assert_authorisation('id')
 @templated()
 def show(id):
     return { 'exp': ConstExpense.get(id) }
 
 @mod.route('/edit/<int:id>', methods=('GET', 'POST'))
 @login_required
+@assert_authorisation('id')
 @templated()
 def edit(id):
     exp = ConstExpense.get(id)
     form = const_form(exp)
 
-    if request.method == 'POST':
+    if form.is_submitted():
         if 'deleteB' in request.form:
             db.session.delete(exp)
             db.session.commit()
@@ -79,6 +84,7 @@ def edit(id):
 
 @mod.route('/add/from/<int:other>')
 @login_required
+@assert_authorisation('other')
 @templated('.add')
 def add_from(other):
     exp = ConstExpense() # needed to initialize 'CE.next'