From 1c6ec3a7d477b536c128b5db512624c2d74b5fc7 Mon Sep 17 00:00:00 2001
From: Tobias Bengfort <bengfort@mpib-berlin.mpg.de>
Date: Wed, 15 Sep 2021 16:47:54 +0200
Subject: [PATCH] hide "add guardian" button on insufficient permision

---
 castellum/contacts/templates/contacts/contact_form.html | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/castellum/contacts/templates/contacts/contact_form.html b/castellum/contacts/templates/contacts/contact_form.html
index bf47abf06..aefefcb92 100644
--- a/castellum/contacts/templates/contacts/contact_form.html
+++ b/castellum/contacts/templates/contacts/contact_form.html
@@ -1,5 +1,5 @@
 {% extends view.base_template|default:"subjects/base.html" %}
-{% load static i18n bootstrap4 %}
+{% load static i18n auth bootstrap4 %}
 
 {% block title %}
     {% if object %}
@@ -47,7 +47,10 @@
                 {% include 'contacts/__guardian_item.html' with name=form.guardians_add.name pk=subject.pk label=subject label=subject.contact.full_name removed=False %}
             {% endfor %}
 
-            <button type="button" class="btn btn-primary" data-js="guardian-add">{% translate 'Add guardian' %}</button>
+            {% has_perm 'subjects.view_subject' user as can_view_subject %}
+            {% if can_view_subject %}
+                <button type="button" class="btn btn-primary" data-js="guardian-add">{% translate 'Add guardian' %}</button>
+            {% endif %}
         </div>
 
         <div class="d-print-none mb-3">
-- 
GitLab