Require change_experiment permission to select winner

hubbs5 · Oct 28, 2016 · 424f7e4 · 424f7e4
1 parent d7c9af9
commit 424f7e4
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/experiments/views.py b/experiments/views.py
@@ -55,6 +55,8 @@ def experiment_report(request, experiment_id):
 
 
 def select_winner(request, experiment_id, variation_id):
+    if not request.user.has_perm('experiments.change_experiment'):
+        raise PermissionDenied
     experiment = get_object_or_404(Experiment, pk=experiment_id)
     variation = get_object_or_404(Page, pk=variation_id)