diff --git a/app/controllers/book_verify.py b/app/controllers/book_verify.py index ad1cac5..2eb6589 100644 --- a/app/controllers/book_verify.py +++ b/app/controllers/book_verify.py @@ -46,7 +46,7 @@ def book_validator() -> Response | None: return redirect(url_for("book.my_library")) collection_id = request_args.get("collection_id") - if collection_id: + if collection_id is not None: collection: m.Collection = db.session.get(m.Collection, collection_id) if not collection or collection.is_deleted: log(log.WARNING, "Collection with id [%s] not found", collection_id) @@ -54,7 +54,7 @@ def book_validator() -> Response | None: return redirect(url_for("book.collection_view", book_id=book_id)) sub_collection_id = request_args.get("sub_collection_id") - if sub_collection_id: + if sub_collection_id is not None: sub_collection: m.Collection = db.session.get(m.Collection, sub_collection_id) if not sub_collection or sub_collection.is_deleted: log(log.WARNING, "Sub_collection with id [%s] not found", sub_collection_id) @@ -66,7 +66,7 @@ def book_validator() -> Response | None: ) section_id = request_args.get("section_id") - if section_id: + if section_id is not None: section: m.Section = db.session.get(m.Section, section_id) if not section: log(log.WARNING, "Section with id [%s] not found", section) @@ -74,7 +74,7 @@ def book_validator() -> Response | None: return redirect(url_for("book.collection_view", book_id=book_id)) interpretation_id = request_args.get("interpretation_id") - if interpretation_id: + if interpretation_id is not None: interpretation: m.Interpretation = db.session.get( m.Interpretation, interpretation_id ) @@ -88,7 +88,7 @@ def book_validator() -> Response | None: ) comment_id = request_args.get("comment_id") - if comment_id: + if comment_id is not None: comment: m.Comment = db.session.get(m.Comment, comment_id) if not comment or comment.is_deleted: log(log.WARNING, "Comment with id [%s] not found", comment_id) diff --git a/app/controllers/require_permission.py b/app/controllers/require_permission.py index 435df99..4014871 100644 --- a/app/controllers/require_permission.py +++ b/app/controllers/require_permission.py @@ -42,6 +42,9 @@ def check_permissions( if type(entity) == m.Comment: log(log.INFO, "Entity is Comment. Replace it by entity.interpretation") entity = entity.interpretation + elif type(entity) == m.Interpretation and entity.user_id == current_user.id: + log(log.INFO, "User [%s] is interpretation creator [%s]", current_user, entity) + return None if not entity or not entity.access_groups: log( diff --git a/app/templates/book/interpretation_view.html b/app/templates/book/interpretation_view.html index 7c56ad0..a4ea015 100644 --- a/app/templates/book/interpretation_view.html +++ b/app/templates/book/interpretation_view.html @@ -146,7 +146,7 @@ {% endif %} - {% if interpretation.book.owner == current_user or access_to_delete_interpretation %} + {% if interpretation.book.owner == current_user or interpretation.user_id == current_user.id or access_to_delete_interpretation %}