fixed bug that deleteWorker has access from `vorstand`

2020-03-05 21:24:32 +01:00 · 2020-03-05 21:24:32 +01:00 · 0d1c116da7
parent e0c3581a4c
commit 0d1c116da7
1 changed files with 1 additions and 1 deletions
--- a/geruecht/vorstand/routes.py
+++ b/geruecht/vorstand/routes.py
@ -117,7 +117,7 @@ def _getUser(**kwargs):
    return  jsonify(retVal)

@vorstand.route("/sm/deleteUser", methods=['POST'])
-@login_required(groups=[MONEY, GASTRO])
+@login_required(groups=[MONEY, GASTRO, VORSTAND])
 def _deletUser(**kwargs):
    data = request.get_json()
    user = data['user']