estelam ticket, varizha , others

apps/messaging/views.py

@@ -23,6 +23,8 @@ def delete(request,public_id):
     msg=get_object_or_404(Message,public_id=public_id); soft_delete_message(msg.pk,request.user); return redirect(_safe_next(request,"/staff/"))
 @login_required
 def revisions(request,public_id):
+    from apps.tickets.dispatch_responses import can_read_response
     msg=get_object_or_404(Message,public_id=public_id)
+    if not can_read_response(request.user, msg): raise PermissionDenied
     if not request.user.has_perm("messaging.view_message_revisions") or not TicketPolicy.can_view(request.user,msg.ticket): raise PermissionDenied
     return render(request,"messaging/revisions.html",{"message":msg,"revisions":msg.revisions.select_related("edited_by")})