From: Michael Tremer <michael.tremer@ipfire.org>
Date: Wed, 28 Jun 2023 15:10:03 +0000 (+0000)
Subject: voip: Make page only accessible for staff
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3eba589bf6dee1097a0b8d0026b2de8d03d8f1e2;p=ipfire.org.git

voip: Make page only accessible for staff

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/web/voip.py b/src/web/voip.py
index b002b448..2594a3db 100644
--- a/src/web/voip.py
+++ b/src/web/voip.py
@@ -9,6 +9,10 @@ from . import ui_modules
 class IndexHandler(base.BaseHandler):
 	@tornado.web.authenticated
 	async def get(self):
+		# Only staff can view this page
+		if not self.current_user.is_staff():
+			raise tornado.web.HTTPError(403)
+
 		registrations, outbound_registrations, = await asyncio.gather(
 			self.backend.asterisk.get_registrations(),
 			self.backend.asterisk.get_outbound_registrations(),