Merge branch 'master' of mowoe.com:reverend/lostplaces-backend

lostplaces/lostplaces_app/views.py

@@ -7,6 +7,8 @@ from django.urls import reverse_lazy
 from django.views.generic.edit import CreateView, UpdateView, DeleteView
 from django.views import View
 from django.http import Http404
+from django.contrib import messages
+from django.contrib.auth.mixins import UserPassesTestMixin
 
 from .forms import (
     ExplorerCreationForm, 
@@ -95,9 +97,22 @@ class PlaceCreateView(View):
             )
             place_image.save()
 
-class PlaceDeleteView(DeleteView):
+class PlaceDeleteView(UserPassesTestMixin, DeleteView):
     template_name = 'place/place_delete.html'
     model = Place
+    success_url = reverse_lazy('place_list')
     
-    def get_success_url(self):
+    def test_func(self):
-        return reverse_lazy('place_list')
+        """ Check if user is eligible to delete place. """
+        if self.request.user.is_superuser:
+            return True
+        
+        place_obj = self.get_object()
+
+        # Check if currently logged in user was the submitter
+        if self.request.user == place_obj.submitted_by:
+            return True
+
+        messages.error(
+            self.request, 'You do not have permission to delete this place.')
+        return False