From 6085ea78ec2626d82033348e1d619b47ba0a4c67 Mon Sep 17 00:00:00 2001
From: Lance Edgar <lance@edbob.org>
Date: Mon, 25 Nov 2024 18:45:36 -0600
Subject: [PATCH] fix: hide CRUD header buttons if master view does not allow

---
 src/wuttaweb/templates/base.mako | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/wuttaweb/templates/base.mako b/src/wuttaweb/templates/base.mako
index 14d0306..6e5d004 100644
--- a/src/wuttaweb/templates/base.mako
+++ b/src/wuttaweb/templates/base.mako
@@ -682,13 +682,13 @@
 <%def name="render_crud_header_buttons()">
   % if master:
       % if master.viewing:
-          % if instance_editable and master.has_perm('edit'):
+          % if master.editable and instance_editable and master.has_perm('edit'):
               <wutta-button once
                             tag="a" href="${master.get_action_url('edit', instance)}"
                             icon-left="edit"
                             label="Edit This" />
           % endif
-          % if instance_deletable and master.has_perm('delete'):
+          % if master.deletable and instance_deletable and master.has_perm('delete'):
               <wutta-button once type="is-danger"
                             tag="a" href="${master.get_action_url('delete', instance)}"
                             icon-left="trash"
@@ -701,7 +701,7 @@
                             icon-left="eye"
                             label="View This" />
           % endif
-          % if instance_deletable and master.has_perm('delete'):
+          % if master.deletable and instance_deletable and master.has_perm('delete'):
               <wutta-button once type="is-danger"
                             tag="a" href="${master.get_action_url('delete', instance)}"
                             icon-left="trash"
@@ -714,7 +714,7 @@
                             icon-left="eye"
                             label="View This" />
           % endif
-          % if instance_editable and master.has_perm('edit'):
+          % if master.editable and instance_editable and master.has_perm('edit'):
               <wutta-button once
                             tag="a" href="${master.get_action_url('edit', instance)}"
                             icon-left="edit"