diff --git a/program/views.py b/program/views.py index 187cd2ed4259e0abdf286b3444ab3f251e75b64e..c8987d96aacc180d797e5f8583d24c579b1f1924 100644 --- a/program/views.py +++ b/program/views.py @@ -593,7 +593,7 @@ class APIScheduleViewSet( them including notes. """ - if not request.user.groups.filter(name=settings.PRIVILEGED_GROUP).exists(): + if not request.user.is_superuser: return Response(status=status.HTTP_401_UNAUTHORIZED) # Only allow updating when with the `schedule` JSON object @@ -721,10 +721,7 @@ class APINoteViewSet( user = self.request.user - if ( - self.request.method in permissions.SAFE_METHODS - or user.groups.filter(name=settings.PRIVILEGED_GROUP).exists() - ): + if self.request.method in permissions.SAFE_METHODS or user.is_superuser: return Note.objects.all() else: return Note.objects.filter(timeslot__schedule__show__owners=user)