Merge pull request #259 from writeas/fix-edit-route-permissions

Require authenticated user on draft edit routes
5 years ago · f902f65365
parent 1a10bb3ed6 1b8f62d143
commit f902f65365
1 changed files with 2 additions and 2 deletions
--- a/routes.go
+++ b/routes.go
@ -178,8 +178,8 @@ func InitRoutes(apper Apper, r *mux.Router) *mux.Router {
 	}

 	// All the existing stuff
-	write.HandleFunc(draftEditPrefix+"/{action}/edit", handler.Web(handleViewPad, UserLevelOptional)).Methods("GET")
-	write.HandleFunc(draftEditPrefix+"/{action}/meta", handler.Web(handleViewMeta, UserLevelOptional)).Methods("GET")
+	write.HandleFunc(draftEditPrefix+"/{action}/edit", handler.Web(handleViewPad, UserLevelUser)).Methods("GET")
+	write.HandleFunc(draftEditPrefix+"/{action}/meta", handler.Web(handleViewMeta, UserLevelUser)).Methods("GET")
 	// Collections
 	if apper.App().cfg.App.SingleUser {
 		RouteCollections(handler, write.PathPrefix("/").Subrouter())