From 0d1c116da75478e2fa970f2ca16be1775e130f4f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tim=20Gr=C3=B6ger?= Date: Thu, 5 Mar 2020 21:24:32 +0100 Subject: [PATCH] fixed bug that deleteWorker has access from `vorstand` --- geruecht/vorstand/routes.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/geruecht/vorstand/routes.py b/geruecht/vorstand/routes.py index c83bff3..26185b8 100644 --- a/geruecht/vorstand/routes.py +++ b/geruecht/vorstand/routes.py @@ -117,7 +117,7 @@ def _getUser(**kwargs): return jsonify(retVal) @vorstand.route("/sm/deleteUser", methods=['POST']) -@login_required(groups=[MONEY, GASTRO]) +@login_required(groups=[MONEY, GASTRO, VORSTAND]) def _deletUser(**kwargs): data = request.get_json() user = data['user']