diff --git a/opentech/apply/funds/views.py b/opentech/apply/funds/views.py index 53cf5217e9f31bba6b2583a59bdabd366c138555..22356b94b024f23d843d30b1ddb5500121e48f80 100644 --- a/opentech/apply/funds/views.py +++ b/opentech/apply/funds/views.py @@ -328,6 +328,11 @@ class AdminSubmissionDetailView(ReviewContextMixin, ActivityContextMixin, Delega def dispatch(self, request, *args, **kwargs): submission = self.get_object() + # Only allow partners in the submission they are added as partners + if request.user.is_partner: + partner_has_access = submission.partners.filter(pk=request.user.pk).exists() + if not partner_has_access: + raise PermissionDenied redirect = SubmissionSealedView.should_redirect(request, submission) return redirect or super().dispatch(request, *args, **kwargs) diff --git a/opentech/apply/users/models.py b/opentech/apply/users/models.py index 5dd11fdda044f6346e54170302b2e8c613250afd..107f966334225e5346ea5903ba183ad890ef5529 100644 --- a/opentech/apply/users/models.py +++ b/opentech/apply/users/models.py @@ -103,7 +103,7 @@ class User(AbstractUser): @cached_property def is_applicant(self): - return not self.is_apply_staff and not self.is_reviewer + return not self.is_apply_staff and not self.is_reviewer and not self.is_partner class Meta: ordering = ('full_name', 'email')