From cbf0257042edefdb456a42142ad3a832cce25352 Mon Sep 17 00:00:00 2001 From: Aiq0 <66842415+Aiq0@users.noreply.github.com> Date: Mon, 3 Nov 2025 09:59:43 +0100 Subject: [PATCH 1/2] fix: CampaignTeamListView permission check --- bullet/bullet_admin/views/emails.py | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/bullet/bullet_admin/views/emails.py b/bullet/bullet_admin/views/emails.py index 304a03e9..9221570b 100644 --- a/bullet/bullet_admin/views/emails.py +++ b/bullet/bullet_admin/views/emails.py @@ -1,3 +1,5 @@ +from functools import cached_property + from competitions.branches import Branch from django.contrib import messages from django.core.exceptions import PermissionDenied @@ -145,19 +147,21 @@ class CampaignTeamListView(PermissionCheckMixin, TemplateView): required_permissions = [is_admin] template_name = "bullet_admin/emails/teams.html" - def dispatch(self, request, *args, **kwargs): - if not self.can_access(): - return self.handle_fail() - - self.campaign = get_object_or_404( + @cached_property + def campaign(self): + return get_object_or_404( EmailCampaign, competition=get_active_competition(self.request), pk=kwargs["pk"], ) - if not can_edit_campaign(self.request, self.campaign): - return self.handle_fail() - return super().dispatch(request, *args, **kwargs) + def check_custom_permission(self, user: User) -> bool | None: + """ + You must be branch admin to edit global emails, + or country admin to edit emails targeting your countries, + or venue admin to edit emails targeting your venues. + """ + return can_edit_campaign(self.request, self.campaign) def get_context_data(self, **kwargs): ctx = super().get_context_data(**kwargs) From d70a7d2a612958319ee06cf499553a914d683ec6 Mon Sep 17 00:00:00 2001 From: Aiq0 <66842415+Aiq0@users.noreply.github.com> Date: Mon, 3 Nov 2025 10:37:17 +0100 Subject: [PATCH 2/2] fix: typo --- bullet/bullet_admin/views/emails.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bullet/bullet_admin/views/emails.py b/bullet/bullet_admin/views/emails.py index 9221570b..787f6fc6 100644 --- a/bullet/bullet_admin/views/emails.py +++ b/bullet/bullet_admin/views/emails.py @@ -152,7 +152,7 @@ def campaign(self): return get_object_or_404( EmailCampaign, competition=get_active_competition(self.request), - pk=kwargs["pk"], + pk=self.kwargs["pk"], ) def check_custom_permission(self, user: User) -> bool | None: