diff --git a/program/views.py b/program/views.py index 99b19f2fc20bdb84777cab54f6973f65a560d475..ea69e683240bfe9027e0ccd134130fc5100628c3 100644 --- a/program/views.py +++ b/program/views.py @@ -1689,9 +1689,11 @@ class APIPlaylistViewSet(viewsets.ModelViewSet): def destroy(self, request, *args, **kwargs): playlist = self.get_object() + user = request.user + user_is_owner = user in playlist.show.owners.all() - if user not in playlist.show.owners.all(): + if not (user.has_perm("program.destroy_playlist") or user_is_owner): raise exceptions.PermissionDenied("You are not allowed to delete this playlist.") playlist.delete()