From a5fa6950f50d0be01606c48607cffca8ff31ead4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20P=C3=A9pin?= <martin.pepin@ens.fr>
Date: Sat, 27 Aug 2016 15:08:36 +0200
Subject: [PATCH] Correction de permissions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

La vue liste des spectacles utilisée par le burô n'était pas protégée
derrière le décorateur `buro_required`.
---
 bda/urls.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bda/urls.py b/bda/urls.py
index 8ec8f277..0866bf95 100644
--- a/bda/urls.py
+++ b/bda/urls.py
@@ -5,6 +5,7 @@ from __future__ import print_function
 from __future__ import unicode_literals
 
 from django.conf.urls import url
+from gestioncof.decorators import buro_required
 from bda.views import SpectacleListView
 from bda import views
 
@@ -23,7 +24,7 @@ urlpatterns = [
         name='bda-etat-places'),
     url(r'^tirage/(?P<tirage_id>\d+)$', views.tirage),
     url(r'^spectacles/(?P<tirage_id>\d+)$',
-        SpectacleListView.as_view(),
+        buro_required(SpectacleListView.as_view()),
         name="bda-liste-spectacles"),
     url(r'^spectacles/(?P<tirage_id>\d+)/(?P<spectacle_id>\d+)$',
         views.spectacle,