modification des permissions de coach: Voit uniquement les tryouts de ses équipes.

Evaluer un joueur retourne à la page précédente au lieu de la page des evaluations

routes/teams.py

@@ -56,11 +56,11 @@ def create_team():
 @teams_bp.route('/<int:team_id>/edit', methods=['POST'])
 @login_required
 def edit_team(team_id):
-    if not current_user.can_manage_teams():
-        flash('You do not have permission to edit teams.', 'danger')
+    team = OrgTeam.query.get_or_404(team_id)
+    if not current_user.can_manage_this_org_team(team):
+        flash('You do not have permission to edit this team.', 'danger')
         return redirect(url_for('teams.list_teams'))
 
-    team = OrgTeam.query.get_or_404(team_id)
     name = request.form.get('name')
     coach_id = request.form.get('coach_id')
 
@@ -105,11 +105,10 @@ def delete_team(team_id):
 @teams_bp.route('/<int:team_id>/add_player', methods=['POST'])
 @login_required
 def add_player(team_id):
-    if not current_user.can_manage_teams():
+    team = OrgTeam.query.get_or_404(team_id)
+    if not current_user.can_manage_this_org_team(team):
         flash('Permission denied.', 'danger')
         return redirect(url_for('teams.list_teams'))
-
-    team = OrgTeam.query.get_or_404(team_id)
     player_id = request.form.get('player_id')
     position = request.form.get('position', '')
 
@@ -138,11 +137,11 @@ def add_player(team_id):
 @teams_bp.route('/<int:team_id>/remove_player/<int:player_id>', methods=['POST'])
 @login_required
 def remove_player(team_id, player_id):
-    if not current_user.can_manage_teams():
+    team = OrgTeam.query.get_or_404(team_id)
+    if not current_user.can_manage_this_org_team(team):
         flash('Permission denied.', 'danger')
         return redirect(url_for('teams.list_teams'))
 
-    team = OrgTeam.query.get_or_404(team_id)
     player = User.query.get_or_404(player_id)
 
     if player.team_id != team_id: