From a1aa2423adfc39e738063d9151ced02ca92492ab Mon Sep 17 00:00:00 2001 From: Yingtong Li Date: Sun, 7 Jun 2020 21:36:10 +1000 Subject: [PATCH] Fix withdraw permission logic --- sstreasury/models.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sstreasury/models.py b/sstreasury/models.py index 0424706..b6b5dbe 100644 --- a/sstreasury/models.py +++ b/sstreasury/models.py @@ -160,8 +160,11 @@ class BudgetRevision(models.Model): return False def can_withdraw(self, user): - if not self.can_edit(user): + if not self.can_view(user): return False + if user != self.author and user not in self.contributors.all() and not user.groups.filter(name='Treasury').exists(): + return False + if self.state == BudgetState.AWAIT_REVIEW.value or self.state == BudgetState.ENDORSED.value: return True return False