people: Show stats only to staff

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/web/people.py b/src/web/people.py
index 1bd146d5b7b9b2e98149e90352e86ba7e85e257e..13d0617fbc6b7daaff212623a590d185bdb19806 100644 (file)
--- a/src/web/people.py
+++ b/src/web/people.py
@@ -224,6 +224,10 @@ class SearchHandler(auth.CacheMixin, base.BaseHandler):
 class StatsHandler(auth.CacheMixin, base.BaseHandler):
        @tornado.web.authenticated
        def get(self):
+               # Only staff can see stats
+               if not self.current_user.is_staff():
+                       raise tornado.web.HTTPError(403)
+
                self.render("people/stats.html")