diff --git a/apps/registration/tests.py b/apps/registration/tests.py index f732f16..00cc564 100644 --- a/apps/registration/tests.py +++ b/apps/registration/tests.py @@ -31,6 +31,10 @@ class TestIndexPage(TestCase): response = self.client.get(reverse("registration:reset_admin")) self.assertRedirects(response, reverse("login") + "?next=" + reverse("registration:reset_admin"), 302, 200) + User.objects.create() + response = self.client.get(reverse("registration:user_detail", args=(1,))) + self.assertRedirects(response, reverse("login") + "?next=" + reverse("registration:user_detail", args=(1,))) + class TestRegistration(TestCase): def setUp(self) -> None: diff --git a/apps/registration/views.py b/apps/registration/views.py index 7fe6707..cf266a8 100644 --- a/apps/registration/views.py +++ b/apps/registration/views.py @@ -158,6 +158,8 @@ class UserDetailView(LoginRequiredMixin, DetailView): def dispatch(self, request, *args, **kwargs): user = request.user + if not user.is_authenticated: + return self.handle_no_permission() # Only an admin or the concerned user can see the information if not user.registration.is_admin and user.pk != kwargs["pk"]: raise PermissionDenied