clubesportsudes/team-tryouts
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ajout de sécurité pour le URL

Browse Source
This commit is contained in:
cedrick2711
2026-07-19 00:36:11 -04:00
parent 614d76581d
commit 482211e6e0
13 changed files with 76 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routes/teams.py
+9 -5
View File
@@ -238,8 +238,10 @@ def add_team_note(team_id):
Response: Redirect to teams list with status message.
"""
team = OrgTeam.query.get_or_404(team_id)
if current_user.role == 'coach' and team.coach_id != current_user.id:
flash('Only the coach of this team can add notes.', 'danger')
# Check if user can manage this team (president, manager, or coach)
if not current_user.can_manage_this_org_team(team):
flash('You do not have permission to add notes to this team.', 'danger')
return redirect(url_for('teams.list_teams'))
content = request.form.get('content', '').strip()
@@ -270,10 +272,12 @@ def add_player_note(team_id, player_id):
Response: Redirect to teams list with status message.
"""
team = OrgTeam.query.get_or_404(team_id)
if current_user.role == 'coach' and team.coach_id != current_user.id:
flash('Only the coach of this team can add notes.', 'danger')
# Check if user can manage this team (president, manager, or coach)
if not current_user.can_manage_this_org_team(team):
flash('You do not have permission to add notes to this team.', 'danger')
return redirect(url_for('teams.list_teams'))
player = User.query.get_or_404(player_id)
if player.role != 'player':
flash('Can only add notes for players.', 'danger')