search

pinax / symposion

a Django project for conference websites
BSD 3-Clause "New" or "Revised" License
299 stars 147 forks source link

Don't show unpublished schedule info to non-staff. #123

Closed martey closed 8 years ago

martey commented 8 years ago

Add checks to schedule_list, schedule_list_csv, and schedule_presentation_detail views to verify that either schedule is published or that current user is staff before displaying information.

c7592bc33e2626d84ec46fe1e7ba8e05c73ef74c added a similar check for schedule_detail, but not the other schedule-related views.

paltman commented 8 years ago

@martey thanks for this. i would like to eventually expose this as a permission check that could be overridden at the site level but I think this is sensible until such time as that hook is implemented.