Add convenience has_permission function.

2 files changed, 7 insertions, 2 deletions

diff --git a/repoze/bfg/sampleapp/templates/blog.pt b/repoze/bfg/sampleapp/templates/blog.pt
index 8eb3945db..b428374fc 100644
--- a/repoze/bfg/sampleapp/templates/blog.pt
+++ b/repoze/bfg/sampleapp/templates/blog.pt
@@ -15,7 +15,7 @@
       <td>${entry.created}</td>
     </tr>
   </table>
-  <p>
+  <p tal:condition="can_add">
     <a href="add_entry.html">Add blog entry</a>
   </p>
 </body>
diff --git a/repoze/bfg/sampleapp/views.py b/repoze/bfg/sampleapp/views.py
index ce591dec2..5b72c8a28 100644
--- a/repoze/bfg/sampleapp/views.py
+++ b/repoze/bfg/sampleapp/views.py
@@ -5,12 +5,17 @@ from webob.exc import HTTPFound
 
 from repoze.bfg.template import render_template
 from repoze.bfg.sampleapp.models import BlogEntry
+from repoze.bfg.security import has_permission
 
 def datestring(dt):
     return dt.strftime('%Y-%m-%d %H:%M:%S')
 
 def blog_default_view(context, request):
     entrydata = []
+
+    can_add = False
+    if has_permission('add', context, request):
+        can_add = True
     for name, entry in context.items():
         entrydata.append(
             {
@@ -23,7 +28,7 @@ def blog_default_view(context, request):
             )
 
     return render_template('templates/blog.pt', name=context.__name__,
-                           entries=entrydata)
+                           entries=entrydata, can_add=can_add)
 
 def blog_entry_default_view(context, request):
     info = {