From ed9d9c22e1ef00cac540dbb39aeb79543e288224 Mon Sep 17 00:00:00 2001
From: Holger Frey <mail@holgerfrey.de>
Date: Wed, 4 Oct 2017 20:12:44 +0200
Subject: [PATCH] order status not changable for normal users

---
 ordr2/schemas/account.py           |  6 +-----
 ordr2/schemas/orders.py            |  8 +++++++-
 ordr2/static/css/style.css         | 11 +++++++++++
 ordr2/templates/orders/list.jinja2 |  2 +-
 4 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/ordr2/schemas/account.py b/ordr2/schemas/account.py
index 818552a..7105867 100644
--- a/ordr2/schemas/account.py
+++ b/ordr2/schemas/account.py
@@ -131,11 +131,7 @@ class SettingsSchema(CSRFSchema):
         settings.update(override)
         form = super().as_form(request, **settings)
         # disable the role field for user settings
-        form['general']['role'].widget = deform.widget.SelectWidget(
-            values=ROLES,
-            template='select_disabled.pt'
-            )
-        form['general']['role'].widget=deform.widget.TextInputWidget(
+        form['general']['role'].widget = deform.widget.TextInputWidget(
             template='textinput_disabled.pt'
             )
         return form
diff --git a/ordr2/schemas/orders.py b/ordr2/schemas/orders.py
index a826d08..be22613 100644
--- a/ordr2/schemas/orders.py
+++ b/ordr2/schemas/orders.py
@@ -177,4 +177,10 @@ class EditOrderSchema(CSRFSchema):
             'css_class': 'form-horizontal'
             }
         settings.update(override)
-        return super().as_form(request, **settings)
+        form = super().as_form(request, **settings)
+        if not 'role:purchaser' in request.user.role_principals:
+            form['order_information']['status'].widget = \
+                deform.widget.TextInputWidget(
+                    template='textinput_disabled.pt'
+                )
+        return form
diff --git a/ordr2/static/css/style.css b/ordr2/static/css/style.css
index 9dae3e9..a86d3cd 100755
--- a/ordr2/static/css/style.css
+++ b/ordr2/static/css/style.css
@@ -463,6 +463,17 @@ table .action.edit:hover {
 	background-position: -16px -52px;
 }
 
+table .action.eye {
+	background-position: -145px 0px;
+}
+
+table .action.eye:hover {
+	background-position: -145px -18px;
+}
+
+
+
+
 /*================================ MODALS ================================*/
 
 .modal form {
diff --git a/ordr2/templates/orders/list.jinja2 b/ordr2/templates/orders/list.jinja2
index 7e907ee..5def803 100644
--- a/ordr2/templates/orders/list.jinja2
+++ b/ordr2/templates/orders/list.jinja2
@@ -96,7 +96,7 @@
                                             {% if request.has_permission('edit', order) %}
                                                 <a href="{{ request.resource_url(order, 'edit') }}" class="action edit" title="Edit Order">edit</a>
                                             {% else %}
-                                                <a href="{{ request.resource_url(order) }}" class="action edit" title="Edit Order">edit</a>
+                                                <a href="{{ request.resource_url(order) }}" class="action eye" title="View Order">edit</a>
                                             {% endif %}
                                             {% if request.has_permission('delete', order) %}
                                                 <a href="{{ request.resource_url(order, 'delete') }}" class="action delete" title="Delete Order">delete</a>