Merge branch 'master' of git://gitorious.org/mediagoblin/mediagoblin

[mediagoblin.git] / mediagoblin / decorators.py

diff --git a/mediagoblin/decorators.py b/mediagoblin/decorators.py
index 6431d67e329ba4b98aa1ddad981dcd4deaa57732..9cac1cfaa9fd1c1529e709cfde5cad389029f9fc 100644 (file)
--- a/mediagoblin/decorators.py
+++ b/mediagoblin/decorators.py
@@ -58,9 +58,9 @@ def user_may_delete_media(controller):
     """
     def wrapper(request, *args, **kwargs):
         uploader = request.db.MediaEntry.find_one(
-            {'_id': ObjectId(request.matchdict['media'])}).uploader()
+            {'slug': request.matchdict['media'] }).uploader()
         if not (request.user['is_admin'] or
-                request.user['_id'] == uploader['_id']):
+                request.user._id == uploader._id):
             return exc.HTTPForbidden()
 
         return controller(request, *args, **kwargs)
@@ -95,11 +95,10 @@ def get_user_media_entry(controller):
 
         if not user:
             return render_404(request)
-
         media = request.db.MediaEntry.find_one(
             {'slug': request.matchdict['media'],
              'state': 'processed',
-             'uploader': user['_id']})
+             'uploader': user._id})
 
         # no media via slug?  Grab it via ObjectId
         if not media:
@@ -107,7 +106,7 @@ def get_user_media_entry(controller):
                 media = request.db.MediaEntry.find_one(
                     {'_id': ObjectId(request.matchdict['media']),
                      'state': 'processed',
-                     'uploader': user['_id']})
+                     'uploader': user._id})
             except InvalidId:
                 return render_404(request)
 
@@ -119,6 +118,7 @@ def get_user_media_entry(controller):
 
     return _make_safe(wrapper, controller)
 
+
 def get_media_entry_by_id(controller):
     """
     Pass in a MediaEntry based off of a url component
@@ -138,4 +138,3 @@ def get_media_entry_by_id(controller):
         return controller(request, media=media, *args, **kwargs)
 
     return _make_safe(wrapper, controller)
-