Check user's authorisation when loading entries by ID.

1 files changed, 4 insertions, 1 deletions

diff --git a/app/views/expenses.py b/app/views/expenses.py
index f5181e9..f36cbb4 100644
--- a/app/views/expenses.py
+++ b/app/views/expenses.py
@@ -1,13 +1,15 @@
 from . import Blueprint, db, \
         current_user, login_required, \
-        templated, redirect, request
+        assert_authorisation, templated, redirect, request
 
 from ..model import Category, SingleExpense, CatExpense, MonthExpense
 from ..forms import ExpenseForm
 
 import datetime, decimal
 from sqlalchemy import sql, func
+from functools import partial
 
+assert_authorisation = partial(assert_authorisation, SingleExpense.get)
 mod = Blueprint('expenses', __name__)
 
 def expense_form(obj=None):
@@ -82,6 +84,7 @@ def show():
 
 @mod.route('/edit/<int:id>', methods=('GET', 'POST'))
 @login_required
+@assert_authorisation('id')
 @templated()
 def edit(id):
     exp = SingleExpense.get(id)