diff --git a/src/backoffice/views.py b/src/backoffice/views.py index 47ff7104..7db09b88 100644 --- a/src/backoffice/views.py +++ b/src/backoffice/views.py @@ -245,10 +245,10 @@ class ExpenseManageDetailView(CampViewMixin, EconomyTeamPermissionMixin, UpdateV expense = form.save() if 'approve' in form.data: # approve button was pressed - expense.approve() + expense.approve(self.request) elif 'reject' in form.data: # reject button was pressed - expense.reject() + expense.reject(self.request) else: messages.error(self.request, "Unknown submit action") return redirect(reverse('backoffice:expense_manage_list', kwargs={'camp_slug': self.camp.slug})) diff --git a/src/economy/admin.py b/src/economy/admin.py index 53ffa8fb..7f902679 100644 --- a/src/economy/admin.py +++ b/src/economy/admin.py @@ -4,13 +4,13 @@ from .models import Expense, Reimbursement def approve_expenses(modeladmin, request, queryset): for expense in queryset.all(): - expense.approve() + expense.approve(request) approve_expenses.short_description = "Approve Expenses" def reject_expenses(modeladmin, request, queryset): for expense in queryset.all(): - expense.reject() + expense.reject(request) reject_expenses.short_description = "Reject Expenses" diff --git a/src/economy/models.py b/src/economy/models.py index 26146163..2a22ef02 100644 --- a/src/economy/models.py +++ b/src/economy/models.py @@ -3,6 +3,7 @@ import os from django.db import models from django.conf import settings from django.db import models +from django.contrib import messages from utils.email import add_outgoing_email from utils.models import CampRelatedModel, UUIDModel @@ -83,11 +84,15 @@ class Expense(CampRelatedModel, UUIDModel): else: return "Rejected" - def approve(self): + def approve(self, request): """ This method marks an expense as approved. Approving an expense triggers an email to the economy system, and another email to the user who submitted the expense in the first place. """ + if request.user == self.user: + messages.error(request, "You cannot approve your own expenses, aka. the anti-stein-bagger defence") + return + self.approved = True self.save() @@ -109,7 +114,9 @@ class Expense(CampRelatedModel, UUIDModel): to_recipients=[self.user.emailaddress_set.get(primary=True).email], ) - def reject(self): + messages.success(request, "Expense %s approved" % self.pk) + + def reject(self, request): """ This method marks an expense as not approved. Not approving an expense triggers an email to the user who submitted the expense in the first place. @@ -125,6 +132,7 @@ class Expense(CampRelatedModel, UUIDModel): to_recipients=[self.user.emailaddress_set.get(primary=True).email], ) + messages.success(request, "Expense %s rejected" % self.pk) class Reimbursement(CampRelatedModel, UUIDModel): """