Changeset 78af3d1 in OpenWorkouts-current for ow/views/workout.py

Timestamp:

Feb 9, 2019, 9:42:52 PM (5 years ago)

Author:

Borja Lopez <borja@…>

Branches:

current, feature/docs, master

Children:

56caf3d

Parents:

55470f9

Message:

Fix permissions. From now on users can see (and edit, delete, etc) their own data

File:

• ow/views/workout.py (modified) (8 diffs)

ow/views/workout.py

@@ -23 +23 @@
 @view_config(
     context=User,
+    permission='edit',
     name='add-workout-manually',
     renderer='ow:templates/add_manual_workout.pt')
@@ -59 +60 @@
 @view_config(
     context=User,
+    permission='edit',
     name='add-workout',
     renderer='ow:templates/add_workout.pt')
@@ -93 +95 @@
 @view_config(
     context=Workout,
+    permission='edit',
     name='edit',
     renderer='ow:templates/edit_manual_workout.pt')
@@ -139 +142 @@
 @view_config(
     context=Workout,
+    permission='edit',
     name='update-from-file',
     renderer='ow:templates/update_workout_from_file.pt')
@@ -167 +171 @@
 @view_config(
     context=Workout,
+    permission='delete',
     name='delete',
     renderer='ow:templates/delete_workout.pt')
@@ -184 +189 @@
 @view_config(
     context=Workout,
+    permission='view',
     renderer='ow:templates/workout.pt')
 def workout(context, request):
@@ -212 +218 @@
     For now, simply return the gpx file if it has been attached to the
     workout.
+
+    This view requires no permission, as we access it from an non-authenticated
+    request in a separate job, to generate the static map screenshot.
     """
     if not context.has_gpx:
@@ -229 +238 @@
 def workout_map(context, request):
     """
-    Render a page that has only a map with tracking info
+    Render a page that has only a map with tracking info.
+    This view requires no permission, as we access it from an non-authenticated
+    request in a separate job, to generate the static map screenshot.
     """
     start_point = {}