Repository: kartoza/prj.app

Issue:
Non project admins see a link to remove items in certifying organisations pending list
I received an email from a user today which included this screenshot:

![unnamed](https://user-images.githubusercontent.com/178003/30458787-771674c8-99ad-11e7-927b-c6b359a35caf.png)


My expectation is that:

a) regular users should not see any CRUD buttons in the UI for pending entries, certifications etc.
b) regular users should only see their own organisations listed in the pending list, not applications from other organisations.

I don't know what happens if he should click those buttons but lets assume the worst and treat this issue as urgent.

cc @cchristelis 


Discussion:
Please also check in other pending views for the same issue...

Resolving patch:
diff --git a/django_project/certification/views/certifying_organisation.py b/django_project/certification/views/certifying_organisation.py
--- a/django_project/certification/views/certifying_organisation.py
+++ b/django_project/certification/views/certifying_organisation.py
@@ -4,6 +4,7 @@
 from django.core.mail import send_mail
 from django.core.urlresolvers import reverse
 from django.shortcuts import get_object_or_404
+from django.db.models import Q
 from django.http import HttpResponse
 from django.views.generic import (
     ListView,
@@ -15,7 +16,7 @@
 from django.http import HttpResponseRedirect, Http404
 from django.db import IntegrityError
 from django.core.exceptions import ValidationError
-from braces.views import LoginRequiredMixin, StaffuserRequiredMixin
+from braces.views import LoginRequiredMixin
 from pure_pagination.mixins import PaginationMixin
 from ..models import (
     CertifyingOrganisation,
@@ -605,8 +606,16 @@ def get_queryset(self):
             self.project_slug = self.kwargs.get('project_slug', None)
             if self.project_slug:
                 self.project = Project.objects.get(slug=self.project_slug)
-                queryset = CertifyingOrganisation.unapproved_objects.filter(
-                    project=self.project)
+                if self.request.user.is_staff:
+                    queryset = \
+                        CertifyingOrganisation.unapproved_objects.filter(
+                            project=self.project)
+                else:
+                    queryset = \
+                        CertifyingOrganisation.unapproved_objects.filter(
+                            Q(project=self.project) &
+                            (Q(project__owner=self.request.user) |
+                             Q(organisation_owners=self.request.user)))
                 return queryset
             else:
                 raise Http404(
@@ -616,7 +625,6 @@ def get_queryset(self):
 
 class ApproveCertifyingOrganisationView(
         CertifyingOrganisationMixin,
-        StaffuserRequiredMixin,
         RedirectView):
     """Redirect view for approving Certifying Organisation."""
 
diff --git a/django_project/changes/views/entry.py b/django_project/changes/views/entry.py
--- a/django_project/changes/views/entry.py
+++ b/django_project/changes/views/entry.py
@@ -392,10 +392,10 @@ def get_queryset(self):
 
 
 class AllPendingEntryList(
+        StaffuserRequiredMixin,
         EntryMixin,
         PaginationMixin,
-        ListView,
-        StaffuserRequiredMixin):
+        ListView):
     """List view for pending Entry."""
     context_object_name = 'unapproved_entries'
     template_name = 'entry/all-pending-list.html'


Test patch: