Use PLC.Person.can_update() to authorize. fix name error.

diff --git a/PLC/Methods/UpdatePersonTag.py b/PLC/Methods/UpdatePersonTag.py
index e07f873..1cfc6ac 100644 (file)
--- a/PLC/Methods/UpdatePersonTag.py
+++ b/PLC/Methods/UpdatePersonTag.py
@@ -53,10 +53,10 @@ class UpdatePersonTag(Method):
         # check permission : it not admin, is the user affiliated with the right person
         if 'admin' not in self.caller['roles']:
             # check caller is affiliated with this person's person
-            if len(set(person['person_ids']) & set(self.caller['person_ids'])) == 0:
+            if not self.call.can_update(person):
                 raise PLCPermissionDenied, "Not a member of the person's persons: %s"%person['person_ids']
 
-            required_min_role = tag_type ['min_role_id']
+            required_min_role = person_tag['min_role_id']
             if required_min_role is not None and \
                     min(self.caller['role_ids']) > required_min_role:
                 raise PLCPermissionDenied, "Not allowed to modify the specified person setting, requires role %d",required_min_role