From a45d57e51a4d7ef3dcb43a14c8c69a18dd63bf03 Mon Sep 17 00:00:00 2001
From: Yohann D'ANELLO <ynerant@crans.org>
Date: Sun, 28 Mar 2021 20:09:29 +0200
Subject: [PATCH] Team member don't have access to other people authorizations

---
 apps/participation/templates/participation/team_detail.html | 2 ++
 apps/participation/views.py                                 | 3 +--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/apps/participation/templates/participation/team_detail.html b/apps/participation/templates/participation/team_detail.html
index 3e5d6c6..6d0505b 100644
--- a/apps/participation/templates/participation/team_detail.html
+++ b/apps/participation/templates/participation/team_detail.html
@@ -101,11 +101,13 @@
             </dd>
         </dl>
 
+        {% if user.registration.is_volunteer %}
         <div class="text-center">
             <a class="btn btn-info" href="{% url "participation:team_authorizations" pk=team.pk %}" data-turbolinks="false">
                 <i class="fas fa-file-archive"></i> {% trans "Download all submitted authorizations" %}
             </a>
         </div>
+        {% endif %}
     </div>
     <div class="card-footer text-center">
         <button class="btn btn-primary" data-toggle="modal" data-target="#updateTeamModal">{% trans "Update" %}</button>
diff --git a/apps/participation/views.py b/apps/participation/views.py
index d0c585e..51670c2 100644
--- a/apps/participation/views.py
+++ b/apps/participation/views.py
@@ -372,8 +372,7 @@ class TeamAuthorizationsView(LoginRequiredMixin, DetailView):
         user = request.user
         if not user.is_authenticated:
             return super().handle_no_permission()
-        if user.registration.is_admin or user.registration.participates and user.registration.team.pk == kwargs["pk"] \
-                or user.registration.is_volunteer \
+        if user.registration.is_admin or user.registration.is_volunteer \
                 and self.get_object().participation.tournament in user.registration.interesting_tournaments:
             return super().dispatch(request, *args, **kwargs)
         raise PermissionDenied