only allow authed admins

router/torrentReportHandler.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/ewhal/nyaa/model"
 	"github.com/ewhal/nyaa/service/moderation"
+	"github.com/ewhal/nyaa/service/user/permission"
 )
 /*
 func SanitizeTorrentReport(torrentReport *model.TorrentReport) {
@@ -47,6 +48,9 @@ func DeleteTorrentReportHandler(w http.ResponseWriter, r *http.Request) {
 }
 */
 func GetTorrentReportHandler(w http.ResponseWriter, r *http.Request) {
+        currentUser := GetUser(r)
+        	if userPermission.HasAdmin(currentUser) {
+
 		torrentReports, err := moderationService.GetTorrentReports()
 		if err != nil {
 			http.Error(w, err.Error(), http.StatusInternalServerError)
@@ -57,6 +61,9 @@ func GetTorrentReportHandler(w http.ResponseWriter, r *http.Request) {
 			http.Error(w, err.Error(), http.StatusInternalServerError)
 			return
 		}
+        } else {
+                http.Error(w, "admins only", http.StatusForbidden)
+        }
 }
 /*