From bf8f976f0736dee7f008f51d80b993a283820bc3 Mon Sep 17 00:00:00 2001 From: Luca Versari Date: Tue, 15 Sep 2026 20:33:30 +0200 Subject: [PATCH] Require auth for seeing/modifying teams. --- cms/server/admin/handlers/user.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/cms/server/admin/handlers/user.py b/cms/server/admin/handlers/user.py index 5469606675..247874a51c 100644 --- a/cms/server/admin/handlers/user.py +++ b/cms/server/admin/handlers/user.py @@ -218,6 +218,7 @@ class TeamHandler(BaseHandler): If referred by GET, this handler will return a pre-filled HTML form. If referred by POST, this handler will sync the team data with the form's. """ + @require_permission(BaseHandler.AUTHENTICATED) def get(self, team_id): team = self.safe_get_item(Team, team_id) @@ -225,6 +226,7 @@ def get(self, team_id): self.r_params["team"] = team self.render("team.html", **self.r_params) + @require_permission(BaseHandler.PERMISSION_ALL) def post(self, team_id): fallback_page = self.url("team", team_id)