Fix users being able to modify other user's email settings

2020-12-05 22:24:21 +00:00
parent f6f4fe4fc6
commit 5a2ce15f96
1 changed files with 3 additions and 0 deletions
--- a/app/blueprints/users/settings.py
+++ b/app/blueprints/users/settings.py
@@ -159,6 +159,9 @@ def email_notifications(username=None):
 	if not user:
 		abort(404)

+	if not user.checkPerm(current_user, Permission.CHANGE_EMAIL):
+		abort(403)
+
 	is_new = False
 	prefs = user.notification_preferences
 	if prefs is None: