From 4841c66602b0fdc35a78d6335583fd1d8f3e1dad Mon Sep 17 00:00:00 2001 From: rubenwardy Date: Mon, 21 May 2018 22:31:50 +0100 Subject: Restrict changing display name to moderator and above --- app/views/users.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'app/views') diff --git a/app/views/users.py b/app/views/users.py index dda53cd..c2460e1 100644 --- a/app/views/users.py +++ b/app/views/users.py @@ -50,14 +50,16 @@ def user_profile_page(username): abort(404) form = None - if user == current_user or user.checkPerm(current_user, Permission.CHANGE_RANK): + if user.checkPerm(current_user, Permission.CHANGE_DNAME) or \ + user.checkPerm(current_user, Permission.CHANGE_EMAIL) or \ + user.checkPerm(current_user, Permission.CHANGE_RANK): # Initialize form form = UserProfileForm(formdata=request.form, obj=user) # Process valid POST if request.method=="POST" and form.validate(): # Copy form fields to user_profile fields - if user == current_user: + if user.checkPerm(current_user, Permission.CHANGE_DNAME): user.display_name = form["display_name"].data if user.checkPerm(current_user, Permission.CHANGE_RANK): -- cgit v1.2.3