Handle permissions on private mailing-lists

1 files changed, 6 insertions, 0 deletions

diff --git a/hyperkitty/views/message.py b/hyperkitty/views/message.py
index 6e3a640..414df68 100644
--- a/hyperkitty/views/message.py
+++ b/hyperkitty/views/message.py
@@ -35,10 +35,12 @@ from hyperkitty.lib import get_store
 from hyperkitty.lib.view_helpers import get_months
 from hyperkitty.lib.posting import post_to_list, PostingFailed
 from hyperkitty.lib.voting import set_message_votes
+from hyperkitty.lib.mailman import check_mlist_private
 from hyperkitty.models import Rating
 from forms import ReplyForm, PostForm
 
 
+@check_mlist_private
 def index(request, mlist_fqdn, message_id_hash):
     '''
     Displays a single message identified by its message_id_hash (derived from
@@ -62,6 +64,7 @@ def index(request, mlist_fqdn, message_id_hash):
     return render(request, "message.html", context)
 
 
+@check_mlist_private
 def attachment(request, mlist_fqdn, message_id_hash, counter, filename):
     """
     Sends the numbered attachment for download. The filename is not used for
@@ -87,6 +90,7 @@ def attachment(request, mlist_fqdn, message_id_hash, counter, filename):
     return response
 
 
+@check_mlist_private
 def vote(request, mlist_fqdn, message_id_hash):
     """ Add a rating to a given message identified by messageid. """
     if request.method != 'POST':
@@ -142,6 +146,7 @@ def vote(request, mlist_fqdn, message_id_hash):
 
 
 @login_required
+@check_mlist_private
 def reply(request, mlist_fqdn, message_id_hash):
     """ Sends a reply to the list.
     TODO: unit tests
@@ -186,6 +191,7 @@ def reply(request, mlist_fqdn, message_id_hash):
 
 
 @login_required
+@check_mlist_private
 def new_message(request, mlist_fqdn):
     """ Sends a new thread-starting message to the list.
     TODO: unit tests