diff --git a/spirit/comment/history/views.py b/spirit/comment/history/views.py index f359d2b0a..a63fe8540 100644 --- a/spirit/comment/history/views.py +++ b/spirit/comment/history/views.py @@ -3,10 +3,13 @@ from __future__ import unicode_literals from django.contrib.auth.decorators import login_required +from django.http import Http404 from django.shortcuts import render, get_object_or_404 +from django.utils.translation import ugettext as _ from djconfig import config +from ...core.conf import settings from ...core.utils.paginator import yt_paginate from .models import CommentHistory from ..models import Comment @@ -17,6 +20,14 @@ def detail(request, comment_id): comment = get_object_or_404(Comment.objects.for_access(request.user), pk=comment_id) + # Block if private is set and not comment author and not moderator: + if (settings.ST_PRIVATE_COMMENT_HISTORY and + request.user != comment.user and + not request.user.st.is_moderator): + raise Http404( + _("You have no right to view other's modification history.") + ) + comments = CommentHistory.objects\ .filter(comment_fk=comment)\ .select_related('comment_fk__user__st')\ diff --git a/spirit/comment/templates/spirit/comment/_render_list.html b/spirit/comment/templates/spirit/comment/_render_list.html index f171593dd..1bcd9d5e4 100644 --- a/spirit/comment/templates/spirit/comment/_render_list.html +++ b/spirit/comment/templates/spirit/comment/_render_list.html @@ -1,7 +1,7 @@ {% load spirit_tags i18n %}
- + {% load_settings "ST_PRIVATE_COMMENT_HISTORY" %} {% for c in comments %}
@@ -22,7 +22,9 @@