permissions on activity (#8992)

Co-authored-by: owocki <[email protected]>
gitcoinco · Jun 3, 2021 · 3d0de86 · 3d0de86
1 parent 60b22ec
commit 3d0de86
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/app/townsquare/views.py b/app/townsquare/views.py
@@ -573,7 +573,14 @@ def api(request, activity_id):
 
     # deletion request
     if request.POST.get('method') == 'delete':
-        activity.delete()
+        has_perms = False
+        if request.user.is_authenticated:
+            if activity.profile and request.user.profile.pk == activity.profile.pk:
+                has_perms = True
+            if activity.other_profile and request.user.other_profile.pk == activity.other_profile.pk:
+                has_perms = True
+        if has_perms:
+            activity.delete()
 
     # deletion request
     if request.POST.get('method') == 'vote':