user perm

g3w-suite · Jan 9, 2024 · 7e5be19 · 7e5be19
1 parent c79dfee
commit 7e5be19
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/g3w-admin/qdjango/api/projects/serializers.py b/g3w-admin/qdjango/api/projects/serializers.py
@@ -599,10 +599,12 @@ def readLeaf(layer, container):
         # reset tokenfilter by session
         self.reset_filtertoken()
 
-        ret['edit_url'] = reverse('qdjango-project-update', kwargs={
-            'group_slug': instance.group.slug,
-            'slug': instance.slug
-        })
+        # add edit url if user has grant
+        if self.request.user.has_perm('qdjango.change_project', instance):
+            ret['edit_url'] = reverse('qdjango-project-update', kwargs={
+                'group_slug': instance.group.slug,
+                'slug': instance.slug
+            })
 
         return ret