fixed rights

rowers/views/statements.py

@@ -474,6 +474,17 @@ def get_workout(id):
 
     return w
 
+def get_workoutuser(id,request):
+    try:
+        id = encoder.decode_hex(id)
+        w = Workout.objects.get(id=id)
+    except Workout.DoesNotExist:
+        raise Http404("Workout doesn't exist")
+
+    if not is_workout_user(request.user,w):
+        raise PermissionDenied
+
+    return w
 
 def getvalue(data):
     perc = 0