From f7b58c844c4c1539f2ba2d527634ffc2fc9b627f Mon Sep 17 00:00:00 2001 From: Chris Hill-Scott Date: Wed, 13 Jun 2018 14:13:39 +0100 Subject: [PATCH] =?UTF-8?q?Don=E2=80=99t=20let=20caseworkers=20download=20?= =?UTF-8?q?CSV=20files?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit No-one can at the moment, but when we bring the links back we should only bring them back for users who care about reporting and management information, ie those with the `view_activity` permission. --- app/main/views/jobs.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/app/main/views/jobs.py b/app/main/views/jobs.py index fe2c3bc6d..fd9e80c30 100644 --- a/app/main/views/jobs.py +++ b/app/main/views/jobs.py @@ -11,7 +11,7 @@ from flask import ( stream_with_context, url_for, ) -from flask_login import login_required +from flask_login import current_user, login_required from notifications_utils.template import Template, WithSubjectTemplate from app import ( @@ -204,7 +204,7 @@ def get_notifications(service_id, message_type, status_override=None): abort(404) filter_args = parse_filter_args(request.args) filter_args['status'] = set_status_filters(filter_args) - if request.path.endswith('csv'): + if request.path.endswith('csv') and current_user.has_permissions('view_activity'): return Response( generate_notifications_csv( service_id=service_id,