Remove can_modify context variable, use is_staff instead
For both ban and modify actions, we trust staff users to not abuse otherwise-secret scripts and links. We don't supply "can_modify" context variable anymore and just use user.is_staff instead. The same goes for ban links and scripts. Signed-off-by: Alek Ratzloff <alekratz@gmail.com>
This commit is contained in:
@@ -12,10 +12,8 @@
|
||||
<script src="{% static 'board/jquery.js' %}"></script>
|
||||
<script src="{% static 'board/jsframe.min.js' %}"></script>
|
||||
<script src="{% static 'board/post.js' %}"></script>
|
||||
{% if perms.board.add_ban %}
|
||||
{% if user.is_staff %}
|
||||
<script src="{% static 'board/ban.js' %}"></script>
|
||||
{% endif %}
|
||||
{% if can_modify %}
|
||||
<script src="{% static 'board/modify.js' %}"></script>
|
||||
{% endif %}
|
||||
{% block extrajs %}{% endblock %}
|
||||
|
||||
Reference in New Issue
Block a user