Harden uploads and enforce language-prefixed routes

claims/admin.py

@@ -1,11 +1,10 @@
-from django.conf import settings
 from django.contrib import admin
 from django.shortcuts import redirect
 from django.urls import path, reverse
 from django.utils import timezone
 from django.utils.html import format_html
 
-from .models import Claim, ClaimLog, Project, SystemSetting
+from .models import Claim, ClaimLog, Project
 
 
 class ClaimLogInline(admin.TabularInline):
@@ -20,7 +19,7 @@ class ClaimAdmin(admin.ModelAdmin):
     list_display = ("full_name", "amount", "currency", "project", "status", "paid", "created_at", "submitted_by")
     list_filter = ("status", "created_at", "project", "paid_at")
     search_fields = ("full_name", "email", "description")
-    base_readonly = ("created_at", "updated_at", "paid_at", "paid_by", "internal_payments_enabled", "reset_paid_button")
+    base_readonly = ("created_at", "updated_at", "paid_at", "paid_by", "reset_paid_button")
     readonly_fields = base_readonly
     inlines = [ClaimLogInline]
     actions = ("mark_as_paid", "mark_as_unpaid")
@@ -29,10 +28,6 @@ class ClaimAdmin(admin.ModelAdmin):
     def paid(self, obj):
         return obj.is_paid
 
-    @admin.display(description="Intern betalningshantering på?")
-    def internal_payments_enabled(self, obj):
-        return SystemSetting.internal_payments_active()
-
     @admin.display(description="Återställ betalning")
     def reset_paid_button(self, obj):
         if not obj.is_paid:
@@ -115,17 +110,6 @@ class ClaimAdmin(admin.ModelAdmin):
         return self.base_readonly
 
 
-@admin.register(SystemSetting)
-class SystemSettingAdmin(admin.ModelAdmin):
-    list_display = ("internal_payments_enabled", "updated_at")
-    list_display_links = ("updated_at",)
-    list_editable = ("internal_payments_enabled",)
-    actions = None
-
-    def has_add_permission(self, request):
-        return not SystemSetting.objects.exists()
-
-
 @admin.register(ClaimLog)
 class ClaimLogAdmin(admin.ModelAdmin):
     list_display = ("claim", "action", "from_status", "to_status", "performed_by", "created_at")