fix acces

diff --git a/project/dae/admin.py b/project/dae/admin.py
index e6c19cf..b61b0fa 100644 (file)
--- a/project/dae/admin.py
+++ b/project/dae/admin.py
@@ -10,7 +10,7 @@ from django.shortcuts import redirect
 from reversion.admin import VersionAdmin
 from auf.django.workflow.models import WorkflowCommentaire
 from models import Poste, Dossier, DossierFinalise, PosteFinalise
-
+from rh.decorators import in_drh_or_admin
 
 class PosteAdmin(VersionAdmin):
     list_display = ('nom', 'implantation', 'etat', )
@@ -142,10 +142,7 @@ class ImportAdmin(admin.ModelAdmin,):
         return False
 
     def has_change_permission(self, request, obj=None):
-        if obj is None:
-            return True
-        else:
-            return False
+        return in_drh_or_admin(request.user)
 
     def get_actions(self, request):
         actions = super(ImportAdmin, self).get_actions(request)

diff --git a/project/recrutement/admin.py b/project/recrutement/admin.py
index 222a1d8..1e18fc6 100644 (file)
--- a/project/recrutement/admin.py
+++ b/project/recrutement/admin.py
@@ -199,7 +199,14 @@ class ProxyOffreEmploiAdmin(OffreEmploiAdmin):
         return False
 
     def has_change_permission(self, request, obj=None):
-        return True
+        user_groupes = request.user.groups.all()
+        if request.user.is_superuser is True or \
+            grp_correspondants_rh_recrutement in user_groupes or \
+            grp_drh_recrutement in user_groupes or \
+            grp_directeurs_bureau_recrutement in user_groupes or \
+            grp_administrateurs_recrutement in user_groupes:
+            return True
+        return False
 
 class CandidatPieceInline(admin.TabularInline):
     model = CandidatPiece
@@ -454,7 +461,14 @@ class ProxyCandidatAdmin(CandidatAdmin):
         return False
 
     def has_change_permission(self, request, obj=None):
-        return True
+        user_groupes = request.user.groups.all()
+        if request.user.is_superuser is True or \
+            grp_correspondants_rh_recrutement in user_groupes or \
+            grp_drh_recrutement in user_groupes or \
+            grp_directeurs_bureau_recrutement in user_groupes or \
+            grp_administrateurs_recrutement in user_groupes:
+            return True
+        return False
 
     def get_actions(self, request):
         return None