mirror of
https://github.com/eitchtee/WYGIWYH.git
synced 2026-09-10 03:41:50 +02:00
Moshe Levi
68a9286ce5
Add apps.common.functions.get_owned_object_or_403, an ownership-enforcing variant of get_object_or_404, and apply it across every rules handler that resolved a TransactionRule / (UpdateOrCreate)TransactionRuleAction from a URL id without an owner check. Mirrors the check in transaction_rule_edit (obj.owner and obj.owner != request.user); objects with no owner remain accessible, preserving existing behaviour. Nested ownership (actions owned via their parent rule) is handled with owner_path='rule.owner'.