From 94b473b1dd2b47d554c1e206b71f68186af9ed08 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=AD=C3=B0ir=20Valberg=20Gu=C3=B0mundsson?= Date: Tue, 31 May 2016 23:30:18 +0200 Subject: [PATCH] Fix EnsureUserOwnsOrderMixin --- shop/views.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/shop/views.py b/shop/views.py index 3574be61..023a5923 100644 --- a/shop/views.py +++ b/shop/views.py @@ -45,8 +45,9 @@ class EnsureUserOwnsOrderMixin(SingleObjectMixin): def dispatch(self, request, *args, **kwargs): # If the user does not own this ticket OR is not staff - if self.get_object().user != request.user or not request.user.is_staff: - raise Http404("Order not found") + if not request.user.is_staff: + if self.get_object().user != request.user: + raise Http404("Order not found") return super(EnsureUserOwnsOrderMixin, self).dispatch( request, *args, **kwargs