diff --git a/cookbook/admin.py b/cookbook/admin.py index 4c4fc5220..0a03093dc 100644 --- a/cookbook/admin.py +++ b/cookbook/admin.py @@ -257,7 +257,7 @@ admin.site.register(ViewLog, ViewLogAdmin) class InviteLinkAdmin(admin.ModelAdmin): list_display = ( - 'group', 'valid_until', + 'group', 'valid_until','space', 'created_by', 'created_at', 'used_by' ) diff --git a/cookbook/views/new.py b/cookbook/views/new.py index 09949be2f..382ba2ab1 100644 --- a/cookbook/views/new.py +++ b/cookbook/views/new.py @@ -201,7 +201,10 @@ class InviteLinkCreate(GroupRequiredMixin, CreateView): def form_valid(self, form): obj = form.save(commit=False) obj.created_by = self.request.user - obj.space = self.request.space + + # verify given space is actually owned by the user creating the link + if obj.space.created_by != self.request.user: + obj.space = self.request.space obj.save() if obj.email: try: