teams: teams guard on all teams update methods.

2019-03-19 13:57:29 +01:00
parent 23231e6d51
commit 1f949e58e1
2 changed files with 36 additions and 6 deletions
@@ -131,5 +131,12 @@ func GetTeamPreferences(c *m.ReqContext) Response {

 // PUT /api/teams/:teamId/preferences
 func UpdateTeamPreferences(c *m.ReqContext, dtoCmd dtos.UpdatePrefsCmd) Response {
-	return updatePreferencesFor(c.OrgId, 0, c.ParamsInt64(":teamId"), &dtoCmd)
+	teamId := c.ParamsInt64(":teamId")
+	orgId := c.OrgId
+
+	if err := teams.CanUpdateTeam(orgId, teamId, c.SignedInUser); err != nil {
+		return Error(403, "Not allowed to update team preferences.", err)
+	}
+
+	return updatePreferencesFor(orgId, 0, teamId, &dtoCmd)
 }