ajout de sécurité pour le URL

routes/evaluations.py

@@ -69,6 +69,12 @@ def evaluate_player(tryout_id, player_id):
         return redirect(url_for('main.dashboard'))
 
     tryout = Tryout.query.get_or_404(tryout_id)
+    
+    # Check if user has permission to evaluate players in this tryout
+    if not current_user.can_manage_this_tryout(tryout):
+        flash('You do not have permission to evaluate players in this tryout.', 'danger')
+        return redirect(url_for('tryouts.list_tryouts'))
+
     player = User.query.get_or_404(player_id)
 
     if player.role != 'player':
@@ -176,6 +182,12 @@ def players_to_evaluate(tryout_id):
         return redirect(url_for('main.dashboard'))
 
     tryout = Tryout.query.get_or_404(tryout_id)
+    
+    # Check if user has permission to evaluate players in this tryout
+    if not current_user.can_manage_this_tryout(tryout):
+        flash('You do not have permission to evaluate players in this tryout.', 'danger')
+        return redirect(url_for('tryouts.list_tryouts'))
+    
     registrations = TryoutRegistration.query.filter_by(tryout_id=tryout_id).all()
     players = []
     for reg in registrations: