jlusiardi
/
rollerverbrauch
1
0
Fork 0
Code Issues 2 Pull Requests Projects Releases 12 Wiki Activity

prevents the deletion of vehicles of other users

This commit is contained in:
Joachim Lusiardi 2016-04-24 12:42:07 +02:00
parent c941e1bccf
commit 3709eddabb
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
app/rollerverbrauch/__init__.py
View File

@ -92,6 +92,11 @@ def edit_vehicle(vid):
@login_required @login_required
def delete_vehicle(vid): def delete_vehicle(vid):
vehicle = Vehicle.query.filter(Vehicle.id == vid).first() vehicle = Vehicle.query.filter(Vehicle.id == vid).first()
# prevent deletion of foreign vehicles
if not vehicle in current_user.vehicles:
return redirect(url_for('get_account_page'))
form = DeleteVehicleForm() form = DeleteVehicleForm()
if form.validate_on_submit(): if form.validate_on_submit():