From: Magnus Hagander <magnus@hagander.net>
Date: Wed, 21 May 2025 16:05:11 +0000 (+0200)
Subject: Use secret based link to sponsor-vouchers invoice on dashboard
X-Git-Url: http://git.postgresql.org/gitweb/delmail?a=commitdiff_plain;h=c70a0a5893c943e95333b39324b8068a865bfb91;p=pgeu-system.git

Use secret based link to sponsor-vouchers invoice on dashboard

There can be multiple managers of a sponsorship, so for all of them to
be able to view (and pay) the invoice, we need to use the secret-url
link rather tha th eone expecting the user to be the same one as the one
who created it.

Spotted by Cornelia Biacsics
---

diff --git a/template/confsponsor/sponsor.html b/template/confsponsor/sponsor.html
index fd81d3e3..9f11f934 100644
--- a/template/confsponsor/sponsor.html
+++ b/template/confsponsor/sponsor.html
@@ -258,7 +258,7 @@ this page.
 </p>
 <ul>
 {%for v in pendingvouchers%}
- <li>Invoice #<a href="/invoices/{{v.invoice.id}}/">{{v.invoice.id}}</a></li>
+ <li>Invoice #<a href="/invoices/{{v.invoice.id}}/{{v.invoice.recipient_secret}}/">{{v.invoice.id}}</a></li>
 {%endfor%}
 </ul>
 {%endif%}