only allow authed admins

router/torrentReportHandler.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/ewhal/nyaa/model"
 	"github.com/ewhal/nyaa/service/moderation"
+	"github.com/ewhal/nyaa/service/user/permission"
 )
 /*
 func SanitizeTorrentReport(torrentReport *model.TorrentReport) {
@@ -47,16 +48,22 @@ func DeleteTorrentReportHandler(w http.ResponseWriter, r *http.Request) {
 }
 */
 func GetTorrentReportHandler(w http.ResponseWriter, r *http.Request) {
-	torrentReports, err := moderationService.GetTorrentReports()
+        currentUser := GetUser(r)
-	if err != nil {
+        	if userPermission.HasAdmin(currentUser) {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+
-		return
+		torrentReports, err := moderationService.GetTorrentReports()
-	}
+		if err != nil {
-	err = torrentReportTemplate.ExecuteTemplate(w, "torrent_report.html", ViewTorrentReportsVariables{model.TorrentReportsToJSON(torrentReports)})
+			http.Error(w, err.Error(), http.StatusInternalServerError)
-	if err != nil {
+			return
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+		}
-		return
+		err = torrentReportTemplate.ExecuteTemplate(w, "torrent_report.html", ViewTorrentReportsVariables{model.TorrentReportsToJSON(torrentReports)})
-	}
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+        } else {
+                http.Error(w, "admins only", http.StatusForbidden)
+        }
 }
 /*