X-Git-Url: http://git.cascardo.info/?p=cascardo%2Fema.git;a=blobdiff_plain;f=eventos%2Fviews.py;h=275958c7b359d379f58e45d0102e5b83ddf31a71;hp=f8b8240801f26606c752db0a6335ddd7149e7f14;hb=bb1123fcfeb4cfc430e1bb4d4f3797df09147e19;hpb=92fd5f3589e395f7ec13d53f476df6e5a0c50608

diff --git a/eventos/views.py b/eventos/views.py
index f8b8240..275958c 100644
--- a/eventos/views.py
+++ b/eventos/views.py
@@ -146,6 +146,10 @@ def speaker_talks(request, lid):
 def talk_details(request, tid):
     """Shows a form to edit a talk
     """
+    # If the user is not a speaker we should not try to show anything.
+    if not hasattr(request.user, 'palestrante_set'):
+        return forbidden
+
     # Selected in settings.py (SITE_ID) variable, because an event can
     # be linked with only one site.
     event = Evento.objects.get(site__id__exact=settings.SITE_ID)
@@ -154,6 +158,11 @@ def talk_details(request, tid):
     entity = get_object_or_404(Trabalho, pk=tid)
     form = TalkForm(request.POST or None, instance=entity)
 
+    # avoiding smart people trying to se talks of other speakers.
+    speaker = request.user.palestrante_set.get()
+    if speaker.id != entity.palestrante.id:
+        return forbidden
+
     # These fields should not be shown to the user.
     form.fields['palestrante'].widget = HiddenInput()
     form.fields['evento'].widget = HiddenInput()