1.1 --- a/app/main/delegation/_action/update.lua	Thu Feb 16 14:08:55 2012 +0100
     1.2 +++ b/app/main/delegation/_action/update.lua	Thu Feb 16 15:01:49 2012 +0100
     1.3 @@ -12,8 +12,6 @@
     1.4    area_id = nil
     1.5  end
     1.6  
     1.7 -local delegation = Delegation:by_pk(truster_id, unit_id, area_id, issue_id)
     1.8 -
     1.9  if param.get("delete") or trustee_id == -1 then
    1.10  
    1.11    if delegation then
    1.12 @@ -33,6 +31,24 @@
    1.13  
    1.14  else
    1.15  
    1.16 +  local check_unit_id
    1.17 +  if unit_id then
    1.18 +    check_unit_id = unit_id
    1.19 +  elseif area_id then
    1.20 +    local area = Area:by_id(area_id)
    1.21 +    check_unit_id = area.unit_id
    1.22 +  else
    1.23 +    local issue = Issue:by_id(issue_id)
    1.24 +    local area = Area:by_id(issue.area_id)
    1.25 +    check_unit_id = area.unit_id
    1.26 +  end
    1.27 +
    1.28 +  if not app.session.member:has_voting_right_for_unit_id(check_unit_id) then
    1.29 +    error("access denied")
    1.30 +  end
    1.31 +
    1.32 +  local delegation = Delegation:by_pk(truster_id, unit_id, area_id, issue_id)
    1.33 +
    1.34    if not delegation then
    1.35      delegation = Delegation:new()
    1.36      delegation.truster_id = truster_id