Fix bug where unauthorized users could interact with source_access

crits · Jul 29, 2019 · 4eab101 · 4eab101
1 parent 7b3a3c5
commit 4eab101
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/crits/core/views.py b/crits/core/views.py
@@ -714,6 +714,7 @@ def source_releasability(request):
         error = "Expected AJAX POST!"
         return render(request, "error.html", {"error" : error })
 
+@user_passes_test(user_can_view_data)
 def source_access(request):
     """
     Modify a user's profile. Should be an AJAX POST.