From ea138a35b7b52bff8e6dfb38ba04d53171e3c3f1 Mon Sep 17 00:00:00 2001
From: Jose Garcia <jose.garcia@geocat.net>
Date: Tue, 8 Apr 2014 10:59:37 +0200
Subject: [PATCH] #441 Metadata editor can be accessed after user logout in
 html5ui (saving metadata fails as expected)

---
 web/src/main/webapp/WEB-INF/config-security-mapping.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/src/main/webapp/WEB-INF/config-security-mapping.xml b/web/src/main/webapp/WEB-INF/config-security-mapping.xml
index 94ea20ffbb6..c3bf34882ec 100644
--- a/web/src/main/webapp/WEB-INF/config-security-mapping.xml
+++ b/web/src/main/webapp/WEB-INF/config-security-mapping.xml
@@ -285,7 +285,7 @@ xsi:schemaLocation="http://www.springframework.org/schema/beans
                 <sec:intercept-url pattern="/srv/[a-z]{2,3}/xml.metadata.status.get!?.*" access="permitAll"></sec:intercept-url>
                 <sec:intercept-url pattern="/srv/[a-z]{2,3}/search!?.*" access="permitAll"></sec:intercept-url>
                 <sec:intercept-url pattern="/srv/[a-z]{2,3}/view!?.*" access="permitAll"></sec:intercept-url>
-                <sec:intercept-url pattern="/srv/[a-z]{2,3}/edit!?.*" access="permitAll"></sec:intercept-url>
+                <sec:intercept-url pattern="/srv/[a-z]{2,3}/edit!?.*" access="hasRole('Editor')"></sec:intercept-url>
                 <sec:intercept-url pattern="/srv/[a-z]{2,3}/q!?.*" access="permitAll"></sec:intercept-url>
                 <sec:intercept-url pattern="/srv/[a-z]{2,3}/portal.search!?.*" access="permitAll"></sec:intercept-url>
                 <sec:intercept-url pattern="/srv/[a-z]{2,3}/portal.opensearch!?.*" access="permitAll"></sec:intercept-url>