diff --git a/kfet/middleware.py b/kfet/middleware.py index 50e5d6b7..3f98488a 100644 --- a/kfet/middleware.py +++ b/kfet/middleware.py @@ -4,6 +4,7 @@ from __future__ import (absolute_import, division, print_function, unicode_literals) from builtins import * +from django.http import HttpResponseForbidden from kfet.backends import KFetBackend class KFetAuthenticationMiddleware(object): @@ -13,3 +14,8 @@ class KFetAuthenticationMiddleware(object): if temp_request_user: request.real_user = request.user request.user = temp_request_user + if request.user.has_perm('kfet.is_team'): + try: + request.user.profile.account_kfet + except RelatedObjectDoesNotExist: + return HttpResponseForbidden