From 9b14e392d8a5c8c388c465ab39d643ba250189cd Mon Sep 17 00:00:00 2001 From: warrenchen Date: Wed, 5 Aug 2026 17:55:26 +0900 Subject: [PATCH] Enforce newsletter campaign add permissions --- innovedus_cms/base/wagtail_hooks.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/innovedus_cms/base/wagtail_hooks.py b/innovedus_cms/base/wagtail_hooks.py index 83e71e8..3d576a4 100644 --- a/innovedus_cms/base/wagtail_hooks.py +++ b/innovedus_cms/base/wagtail_hooks.py @@ -1,11 +1,11 @@ from django import forms -from django.contrib.admin.views.decorators import staff_member_required from django.urls import path from django.urls import reverse from django.utils.translation import gettext as _ from django.shortcuts import redirect from django.shortcuts import render from wagtail import hooks +from wagtail.admin.auth import permission_required, require_admin_access from wagtail.admin.menu import MenuItem from wagtail.admin.panels import FieldPanel from wagtail.admin.ui.tables import Column @@ -29,6 +29,7 @@ from .models import ( ) SEND_NEWSLETTER_PERMISSION = "base.send_newslettercampaign" +ADD_NEWSLETTER_PERMISSION = "base.add_newslettercampaign" def _contact_status_value(submission): @@ -58,7 +59,8 @@ def _newsletter_campaign_add_url() -> str: return "/admin/snippets/base/newslettercampaign/add/" -@staff_member_required +@require_admin_access +@permission_required(ADD_NEWSLETTER_PERMISSION) def newsletter_campaign_type_select_view(request): return render( request, @@ -72,7 +74,8 @@ def newsletter_campaign_type_select_view(request): ) -@staff_member_required +@require_admin_access +@permission_required(ADD_NEWSLETTER_PERMISSION) def newsletter_campaign_add_by_type_view(request, campaign_type: str): campaign_type = (campaign_type or "").strip() allowed = {NewsletterCampaign.TYPE_GENERAL, NewsletterCampaign.TYPE_WEEKLY_NEWS}