From 31df41283c6a57386fc7bc2d29d0fa728c33f90d Mon Sep 17 00:00:00 2001
From: Lance Edgar <lance@edbob.org>
Date: Fri, 12 Jun 2020 18:40:10 -0500
Subject: [PATCH] Don't allow edit/delete of rows, if master view says so

also fix "back to parent" link when viewing row
---
 tailbone/templates/master/view_row.mako |  2 +-
 tailbone/views/master.py                | 10 +++++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/tailbone/templates/master/view_row.mako b/tailbone/templates/master/view_row.mako
index f8aa2acb..66756c3e 100644
--- a/tailbone/templates/master/view_row.mako
+++ b/tailbone/templates/master/view_row.mako
@@ -8,7 +8,7 @@
 </%def>
 
 <%def name="context_menu_items()">
-  <li>${h.link_to("Back to {}".format(parent_model_title), index_url)}</li>
+  <li>${h.link_to("Back to {}".format(parent_model_title), instance_url)}</li>
   % if master.rows_editable and instance_editable and request.has_perm('{}.edit'.format(permission_prefix)):
       <li>${h.link_to("Edit this {}".format(model_title), action_url('edit', instance))}</li>
   % endif
diff --git a/tailbone/views/master.py b/tailbone/views/master.py
index a263ffce..b445bf3e 100644
--- a/tailbone/views/master.py
+++ b/tailbone/views/master.py
@@ -3324,6 +3324,9 @@ class MasterView(View):
         """
         self.editing = True
         row = self.get_row_instance()
+        if not self.row_editable(row):
+            raise self.redirect(self.get_row_action_url('view', row))
+
         form = self.make_row_form(row)
 
         if self.request.method == 'POST':
@@ -3407,9 +3410,10 @@ class MasterView(View):
         """
         Desktop view which can "delete" a sub-row from the parent.
         """
-        row = self.Session.query(self.model_row_class).get(self.request.matchdict['row_uuid'])
-        if not row:
-            raise self.notfound()
+        row = self.get_row_instance()
+        if not self.row_deletable(row):
+            raise self.redirect(self.get_row_action_url('view', row))
+
         self.delete_row_object(row)
         return self.redirect(self.get_action_url('view', self.get_parent(row)))