Correct: raise instead of return

finances/views.py

@@ -85,7 +85,7 @@ def subsidy_attachment(request, subsidy_id, attachment_id):
     attachment = get_object_or_404(SubsidyAttachment.objects,
                                    subsidy__id=subsidy_id, id=attachment_id)
     if not attachment.visible_to_user(request.user):
-        return PermissionDenied
+        raise PermissionDenied
     content_type, encoding = mimetypes.guess_type(attachment.attachment.path)
     content_type = content_type or 'application/octet-stream'
     response = HttpResponse(attachment.attachment.read(), content_type=content_type)