diff --git a/app/controllers/serviceLearning/routes.py b/app/controllers/serviceLearning/routes.py index 082404be4..655bc4c67 100644 --- a/app/controllers/serviceLearning/routes.py +++ b/app/controllers/serviceLearning/routes.py @@ -22,11 +22,14 @@ @serviceLearning_bp.route('/serviceLearning/courseManagement', methods = ['GET']) @serviceLearning_bp.route('/serviceLearning/courseManagement/', methods = ['GET']) def serviceCourseManagement(username=None): - if g.current_user.isStudent: - abort(403) - if g.current_user.isCeltsAdmin or g.current_user.isFaculty: - setRedirectTarget("/serviceLearning/courseManagement") + try: user = User.get(User.username==username) if username else g.current_user + except DoesNotExist: + abort(404) + + isRequestingForSelf = g.current_user == user + if g.current_user.isCeltsAdmin or (g.current_user.isFaculty and isRequestingForSelf): + setRedirectTarget(request.full_path) courseDict = getServiceLearningCoursesData(user) termList = selectSurroundingTerms(g.current_term, prevTerms=0) return render_template('serviceLearning/slcManagement.html', @@ -34,8 +37,8 @@ def serviceCourseManagement(username=None): courseDict=courseDict, termList=termList) else: - flash("Unauthorized to view page", 'warning') - return redirect(url_for('main.events', selectedTerm=g.current_term)) + abort(403) + @serviceLearning_bp.route('/serviceLearning/viewProposal/', methods=['GET']) @serviceLearning_bp.route('/serviceLearning/editProposal/upload/', methods=['GET'])