From 0f57a43bfbed7d4df779e357585e7c67122addac Mon Sep 17 00:00:00 2001
From: Mouse Reeve <mousereeve@riseup.net>
Date: Mon, 27 Sep 2021 13:31:35 -0700
Subject: [PATCH] Separate access controls for delete and re-order

---
 bookwyrm/templates/lists/list.html | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/bookwyrm/templates/lists/list.html b/bookwyrm/templates/lists/list.html
index 241bc408..dbee2f1f 100644
--- a/bookwyrm/templates/lists/list.html
+++ b/bookwyrm/templates/lists/list.html
@@ -66,15 +66,14 @@
                             <p>{% blocktrans with username=item.user.display_name user_path=item.user.local_path %}Added by <a href="{{ user_path }}">{{ username }}</a>{% endblocktrans %}</p>
                             </div>
                         </div>
-                        {% if list.user != request.user %}
-                        {% if list.curation == 'open' and item.user == request.user %}
+                        {% if list.user == request.user %}
                         <div class="card-footer-item">
                             <form name="set-position" method="post" action="{% url 'list-set-book-position' item.id %}">
+                                {% csrf_token %}
                                 <div class="field has-addons mb-0">
                                     <div class="control">
                                         <label for="input-list-position" class="button is-transparent is-small">{% trans "List position" %}</label>
                                     </div>
-                                    {% csrf_token %}
                                     <div class="control">
                                         <input id="input_list_position" class="input is-small" type="number" min="1" name="position" value="{{ item.order }}">
                                     </div>
@@ -84,13 +83,14 @@
                                 </div>
                             </form>
                         </div>
-                        <form name="add-book" method="post" action="{% url 'list-remove-book' list.id %}" class="card-footer-item">
+                        {% endif %}
+                        {% if list.user == request.user or list.curation == 'open' and item.user == request.user %}
+                        <form name="remove-book" method="post" action="{% url 'list-remove-book' list.id %}" class="card-footer-item">
                             {% csrf_token %}
                             <input type="hidden" name="item" value="{{ item.id }}">
                             <button type="submit" class="button is-small is-danger">{% trans "Remove" %}</button>
                         </form>
                         {% endif %}
-                        {% endif %}
                     </div>
                 </div>
             </li>