Fix permission check on operations

The original code was too restrictive and didn't allow some users to
trigger pull/push.
Signed-off-by: Michal Čihař <michal@cihar.com>

weblate/api/views.py

@@ -106,9 +106,6 @@ class WeblateViewSet(viewsets.ReadOnlyModelViewSet):
         else:
             project = obj
 
-        if not can_see_repository_status(request.user, project):
-            raise PermissionDenied()
-
         if request.method == 'POST':
             serializer = RepoRequestSerializer(data=request.data)
             serializer.is_valid(raise_exception=True)
@@ -117,6 +114,9 @@ class WeblateViewSet(viewsets.ReadOnlyModelViewSet):
                 request, obj, project, serializer.validated_data['operation']
             )
 
+        if not can_see_repository_status(request.user, project):
+            raise PermissionDenied()
+
         return Response(
             data={
                 'needs_commit': obj.repo_needs_commit(),