From c9f61e5defafb99af425595d61a7980988cfeaa0 Mon Sep 17 00:00:00 2001
From: Adarnof <adarnof@gmail.com>
Date: Sat, 28 Nov 2015 01:52:49 +0000
Subject: [PATCH] Added new permission model to view timer boards. Enforced
 permission on base template for link to timerboard as well as view rendering.
 Addresses #15

---
 stock/templates/public/base.html | 13 +++++++------
 timerboard/views.py              |  1 +
 util/__init__.py                 |  1 +
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/stock/templates/public/base.html b/stock/templates/public/base.html
index d2153f1e..279743d0 100755
--- a/stock/templates/public/base.html
+++ b/stock/templates/public/base.html
@@ -137,12 +137,13 @@
                                                                                   href="{% url 'auth_fleet_fits' %}"><i
                                         class="fa fa-bolt fa-fw grayiconecolor"></i> Fleet Doctrines</a>
                             </li>
-                            <li>
-                                <a {% ifequal request.path "/timer_management" %} class="active" {% endifequal %}
-                                                                                  href="{% url 'auth_timer_view' %}"><i
-                                        class="fa fa-clock-o fa-fw grayiconecolor"></i> OP Timers</a>
-                            </li>
-
+                            {% if perms.auth.timer_view %}
+                                <li>
+                                    <a {% ifequal request.path "/timer_management" %} class="active" {% endifequal %}
+                                                                                      href="{% url 'auth_timer_view' %}"><i
+                                            class="fa fa-clock-o fa-fw grayiconecolor"></i> OP Timers</a>
+                                </li>
+                            {% endif %}
 
                             <li>
                                 <a {% ifequal request.path "/srp/" %} class="active" {% endifequal %}
diff --git a/timerboard/views.py b/timerboard/views.py
index d347ecbb..25603d17 100755
--- a/timerboard/views.py
+++ b/timerboard/views.py
@@ -20,6 +20,7 @@ def timer_util_test(user):
 
 @login_required
 @user_passes_test(timer_util_test)
+@permission_required('auth.timer_view')
 def timer_view(request):
     timer_list = Timer.objects.all()
     closest_timer = None
diff --git a/util/__init__.py b/util/__init__.py
index 99a8cbbc..c3821670 100755
--- a/util/__init__.py
+++ b/util/__init__.py
@@ -16,6 +16,7 @@ def bootstrap_permissions():
     Permission.objects.get_or_create(codename="blue_member", content_type=ct, name="blue_member")
     Permission.objects.get_or_create(codename="corp_stats", content_type=ct, name="corp_stats")
     Permission.objects.get_or_create(codename="timer_management", content_type=ct, name="timer_management")
+    Permission.objects.get_or_create(codename="timer_view", content_type=ct, name="timer_view")
     Permission.objects.get_or_create(codename="srp_management", content_type=ct, name="srp_management")
     Group.objects.get_or_create(name=settings.DEFAULT_AUTH_GROUP)
     Group.objects.get_or_create(name=settings.DEFAULT_BLUE_GROUP)