From 493917d8b14fac50ca2ad8f6c8ffff0c0403a5e1 Mon Sep 17 00:00:00 2001
From: rubenwardy <rw@rubenwardy.com>
Date: Sat, 25 Jan 2020 00:04:56 +0000
Subject: Restrict webhooks to trusted users

---
 app/templates/packages/view.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'app/templates')

diff --git a/app/templates/packages/view.html b/app/templates/packages/view.html
index e5ab1e4..9dce0d4 100644
--- a/app/templates/packages/view.html
+++ b/app/templates/packages/view.html
@@ -364,7 +364,7 @@
 				</ul>
 			</div>
 
-			{% if package.getIsOnGitHub() %}
+			{% if package.author == current_user and package.checkPerm(current_user, "APPROVE_RELEASE") and package.getIsOnGitHub() %}
 			<p class="small text-centered">
 				<a href="{{ url_for('github.setup_webhook', pid=package.id) }}">
 					Set up a webhook
-- 
cgit v1.2.3