From b40dce27dfe65f849005c45a19f01b5588525a27 Mon Sep 17 00:00:00 2001
From: Emmy D'Anello <emmy.danello@animath.fr>
Date: Sun, 9 Apr 2023 11:32:26 +0200
Subject: [PATCH] Juries can't download ZIP archives with authorizations

Signed-off-by: Emmy D'Anello <emmy.danello@animath.fr>
---
 .../templates/participation/team_detail.html         | 12 +++++++-----
 participation/views.py                               |  4 ++--
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/participation/templates/participation/team_detail.html b/participation/templates/participation/team_detail.html
index 45a29bb..0d6e0ed 100644
--- a/participation/templates/participation/team_detail.html
+++ b/participation/templates/participation/team_detail.html
@@ -115,11 +115,13 @@
         </dl>
 
         {% if user.registration.is_volunteer %}
-        <div class="text-center">
-            <a class="btn btn-info" href="{% url "participation:team_authorizations" pk=team.pk %}">
-                <i class="fas fa-file-archive"></i> {% trans "Download all submitted authorizations" %}
-            </a>
-        </div>
+            {% if user.registration in self.team.participation.tournament.organizers or user.registration.is_admin %}
+                <div class="text-center">
+                    <a class="btn btn-info" href="{% url "participation:team_authorizations" pk=team.pk %}">
+                        <i class="fas fa-file-archive"></i> {% trans "Download all submitted authorizations" %}
+                    </a>
+                </div>
+            {% endif %}
         {% endif %}
     </div>
     <div class="card-footer text-center">
diff --git a/participation/views.py b/participation/views.py
index 523d988..7232b8a 100644
--- a/participation/views.py
+++ b/participation/views.py
@@ -392,9 +392,9 @@ class TeamAuthorizationsView(LoginRequiredMixin, DetailView):
         if not user.is_authenticated:
             return super().handle_no_permission()
         if user.registration.is_admin or user.registration.is_volunteer \
-                and (self.get_object().participation.tournament in user.registration.interesting_tournaments
+                and (user.registration in self.get_object().participation.tournament.organizers
                      or self.get_object().participation.final
-                     and Tournament.final_tournament() in user.registration.interesting_tournaments):
+                     and user.registration in Tournament.final_tournament().organizers):
             return super().dispatch(request, *args, **kwargs)
         raise PermissionDenied