protect against usurpation

[auf_rh_dae.git] / project / recrutement / admin.py

diff --git a/project/recrutement/admin.py b/project/recrutement/admin.py
index 79c7c75..6b346c2 100644 (file)
--- a/project/recrutement/admin.py
+++ b/project/recrutement/admin.py
@@ -496,8 +496,13 @@ class CandidatEvaluationAdmin(admin.ModelAdmin):
         }),
     )
 
         }),
     )
 

-    ### Actions à afficher

     def get_actions(self, request):
     def get_actions(self, request):

+        # on stocke l'evaluateur connecté (pas forcément la meilleure place...)
+        try:
+            self.evaluateur = Evaluateur.objects.get(user=request.user)
+        except:
+            self.evaluateur = None
+

         actions = super(CandidatEvaluationAdmin, self).get_actions(request)
         del actions['delete_selected']
         return actions
         actions = super(CandidatEvaluationAdmin, self).get_actions(request)
         del actions['delete_selected']
         return actions

@@ -511,9 +516,16 @@ class CandidatEvaluationAdmin(admin.ModelAdmin):
         """
         page = self.model.__name__.lower()
         redirect_url = 'admin:recrutement_%s_change' % page
         """
         page = self.model.__name__.lower()
         redirect_url = 'admin:recrutement_%s_change' % page

+        

         if obj.note is None:
         if obj.note is None:

-            return "<a href='%s'>Candidat non évalué</a>" % (reverse(redirect_url,  args=(obj.id,)))
-        return "<a href='%s'>%s</a>" % (reverse(redirect_url, args=(obj.id,)), obj.note)
+            label = "Candidat non évalué"
+        else:
+            label = obj.note
+
+        if self.evaluateur == obj.evaluateur:
+            return "<a href='%s'>%s</a>" % (reverse(redirect_url,  args=(obj.id,)), label)
+        else:
+            return label

     _note.allow_tags = True
     _note.short_description = "Note"    
     _note.admin_order_field = 'note'    
     _note.allow_tags = True
     _note.short_description = "Note"    
     _note.admin_order_field = 'note'    

@@ -625,7 +637,7 @@ class MesCandidatEvaluationAdmin(CandidatEvaluationAdmin):
         except:
             is_evaluateur = False
 
         except:
             is_evaluateur = False
 

-        if obj is None or is_evaluateur:
+        if obj is None and is_evaluateur:

             return True
 
         try:
             return True
 
         try: