raise permission denied for playlist not visible

EsupPortail · May 4, 2020 · 6590aa0 · 6590aa0
1 parent a4245d9
commit 6590aa0
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/pod/video/views.py b/pod/video/views.py
@@ -495,6 +495,13 @@ def render_video(request, id, slug_c=None, slug_t=None, slug_private=None,
     playlist = get_object_or_404(
         Playlist,
         slug=request.GET['playlist']) if request.GET.get('playlist') else None
+    if playlist and request.user != playlist.owner and not playlist.visible:
+        # not (request.user.is_superuser or request.user.has_perm(
+        #        "video.change_theme")
+        messages.add_message(
+            request, messages.ERROR,
+            _('You don\'t have access to this playlist.'))
+        raise PermissionDenied
 
     is_password_protected = (
         video.password is not None and video.password != '')