don't allow non-manager to add and remove group members

2021-09-25 20:25:30 +10:00
parent 035fc5209d
commit ec0720514e
2 changed files with 6 additions and 5 deletions
--- a/bookwyrm/templates/snippets/add_to_group_button.html
+++ b/bookwyrm/templates/snippets/add_to_group_button.html
@ -1,5 +1,5 @@
 {% load i18n %}
-{% if request.user == user or not request.user.is_authenticated %}
+{% if request.user == user or not request.user == group.manager or not request.user.is_authenticated %}
 <!-- TODO: blocking is irrelevant here, but ...is it? -->
 {% elif user in request.user.blocks.all %}
 {% include 'snippets/block_button.html' with blocks=True %}