Prevent users who are not granted updated privileges through roles for a table from updating that table

[ethanstrominger]

Overview

As a user I want only authorized users to update information so that the information is accurate.

Solution

• Sample code for preventing unauthorized updates

    if not request.user.has_perm('core.change_practice_area'):
        # If the user doesn't have permission, return forbidden response
       return HttpResponseForbidden("You don't have permission to update practice area.")

Similar code can be written for creating and deleting.

Action Items

• Implement code
• Write tests