From c451daad3cbe0a134dc5fda5ea6c233e0fbbefab Mon Sep 17 00:00:00 2001
From: jvoisin <julien.voisin@dustri.org>
Date: Tue, 14 Apr 2026 22:25:36 +0200
Subject: [PATCH] Don't allow users to edit shelves they don't have permission
 to edit.

---
 cps/shelf.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/cps/shelf.py b/cps/shelf.py
index e5fb46707..95ae783c6 100644
--- a/cps/shelf.py
+++ b/cps/shelf.py
@@ -308,6 +308,9 @@ def order_shelf(shelf_id):
     shelf = ub.session.query(ub.Shelf).filter(ub.Shelf.id == shelf_id).first()
     if shelf and check_shelf_view_permissions(shelf):
         if request.method == "POST":
+            if not check_shelf_edit_permissions(shelf):
+                flash(_("Sorry you are not allowed to edit this shelf"), category="error")
+                return redirect(url_for('web.index'))
             to_save = request.form.to_dict()
             books_in_shelf = ub.session.query(ub.BookShelf).filter(ub.BookShelf.shelf == shelf_id).order_by(
                 ub.BookShelf.order.asc()).all()