X-Git-Url: https://git.mdrn.pl/redakcja.git/blobdiff_plain/d8990e1ab64fe3bf453d06fab8e983d25f2df2c4..896fad710142a7c82b849ffe9f0d492d6a99c5ca:/apps/catalogue/views.py?ds=sidebyside diff --git a/apps/catalogue/views.py b/apps/catalogue/views.py index c6ae4197..e6f6cca7 100644 --- a/apps/catalogue/views.py +++ b/apps/catalogue/views.py @@ -205,6 +205,8 @@ def upload(request): def serve_xml(request, book, slug): + if not book.accessible(request): + return HttpResponseForbidden("Not authorized.") xml = book.materialize(publishable=True) response = http.HttpResponse(xml, content_type='application/xml') response['Content-Disposition'] = 'attachment; filename=%s.xml' % slug @@ -214,14 +216,11 @@ def serve_xml(request, book, slug): @never_cache def book_xml(request, slug): book = get_object_or_404(Book, slug=slug) - if not book.accessible(request): - return HttpResponseForbidden("Not authorized.") return serve_xml(request, book, slug) @never_cache def book_xml_dc(request, slug): - # no permission check, because non-public books book = get_object_or_404(Book, dc_slug=slug) return serve_xml(request, book, slug)