diff --git a/registration/views.py b/registration/views.py index e74c337..b959ac3 100644 --- a/registration/views.py +++ b/registration/views.py @@ -449,9 +449,13 @@ class PaymentUpdateView(LoginRequiredMixin, UpdateView): form_class = PaymentAdminForm def dispatch(self, request, *args, **kwargs): - if not self.request.user.is_authenticated or \ - not self.request.user.registration.is_admin \ - and self.request.user.registration not in self.get_object().registrations.all(): + user = self.request.user + object = self.get_object() + if not user.is_authenticated or \ + not user.registration.is_admin \ + and (user.registration.is_volunteer and user.registration in object.tournament.organizers.all() + or user.registration.is_student and user.registration not in object.registrations.all() + or user.registration.is_coach and user.registration.team != object.team): return self.handle_no_permission() return super().dispatch(request, *args, **kwargs)