diff --git a/alliance_auth/urls.py b/alliance_auth/urls.py index 6f08c93f..4d812dea 100755 --- a/alliance_auth/urls.py +++ b/alliance_auth/urls.py @@ -189,5 +189,5 @@ urlpatterns = patterns('', # Notifications url(r'^notifications/$', 'notifications.views.notification_list', name='auth_notification_list'), url(r'^notifications/(\w+)/$', 'notifications.views.notification_view', name='auth_notification_view'), - url(r'^remove_notifications/(\w+)', 'notifications.views.remove_notification', name='auth_remove_notification'), + url(r'^remove_notifications/(\w+)/$', 'notifications.views.remove_notification', name='auth_remove_notification'), ) diff --git a/notifications/views.py b/notifications/views.py index 98ecf5a8..c6252cb7 100644 --- a/notifications/views.py +++ b/notifications/views.py @@ -33,10 +33,11 @@ def notification_view(request, notif_id): @login_required def remove_notification(request, notif_id): logger.debug("remove notification called by user %s for notif_id %s" % (request.user, notif_id)) - if Notification.objects.filter(id=notif_id).exists(): - notif = get_object_or_404(Notification, pk=notif_id) - notif.delete() - logger.info("Deleting notif id %s by user %s" % (notif_id, request.user)) + notif = get_object_or_404(Notification, pk=notif_id) + if notif.user == request.user: + if Notification.objects.filter(id=notif_id).exists(): + notif.delete() + logger.info("Deleting notif id %s by user %s" % (notif_id, request.user)) else: logger.error("Unable to delete notif id %s for user %s - notif matching id not found." % (notif_id, request.user)) - return redirect('auth_notification_list') \ No newline at end of file + return redirect('auth_notification_list')