voip: Make page only accessible for staff

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/web/voip.py b/src/web/voip.py
index b002b4481a6510ec7251e1be1dc43d03e1f5198e..2594a3dba748271666acd20b0fabfd9d2cc9376b 100644 (file)
--- a/src/web/voip.py
+++ b/src/web/voip.py
@@ -9,6 +9,10 @@ from . import ui_modules
 class IndexHandler(base.BaseHandler):
        @tornado.web.authenticated
        async def get(self):
+               # Only staff can view this page
+               if not self.current_user.is_staff():
+                       raise tornado.web.HTTPError(403)
+
                registrations, outbound_registrations, = await asyncio.gather(
                        self.backend.asterisk.get_registrations(),
                        self.backend.asterisk.get_outbound_registrations(),