Treasurers can of course click on buttons. Fix PATCH requests on the API

apps/permission/fixtures/initial.json

@@ -2119,6 +2119,22 @@
 			"description": "Update the clothing size field of my own WEI Registration"
 		}
 	},
+	{
+		"model": "permission.permission",
+		"pk": 132,
+		"fields": {
+			"model": [
+				"note",
+				"recurrenttransaction"
+			],
+			"query": "{}",
+			"type": "add",
+			"mask": 2,
+			"field": "",
+			"permanent": false,
+			"description": "Create any recurrent transaction"
+		}
+	},
 	{
 		"model": "permission.role",
 		"pk": 1,
@@ -2279,7 +2295,8 @@
 				69,
 				71,
 				72,
-				73
+				73,
+				132
 			]
 		}
 	},
@@ -2415,7 +2432,13 @@
 				123,
 				124,
 				125,
-				126
+				126,
+				127,
+				128,
+				129,
+				130,
+				131,
+				132
 			]
 		}
 	},

apps/permission/permissions.py

@@ -19,8 +19,8 @@ class StrongDjangoObjectPermissions(DjangoObjectPermissions):
         'OPTIONS': [],
         'HEAD': [],
         'POST': ['%(app_label)s.add_%(model_name)s'],
-        'PUT': ['%(app_label)s.change_%(model_name)s'],
-        'PATCH': ['%(app_label)s.change_%(model_name)s'],
+        'PUT': [],      # ['%(app_label)s.change_%(model_name)s'],
+        'PATCH': [],    # ['%(app_label)s.change_%(model_name)s'],
         'DELETE': ['%(app_label)s.delete_%(model_name)s'],
     }