check authentication before deleting quotes

vtluug · Apr 29, 2012 · 84bd634 · 84bd634
1 parent 12d1b99
commit 84bd634
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/pyqdb.py b/src/pyqdb.py
@@ -260,6 +260,8 @@ def single(quote_id):
 
 @app.route('/quotes/<int:quote_id>', methods=['DELETE'])
 def remove(quote_id):
+    if not 'user' in session:
+        abort(403)
     quote = db.get(quote_id)
     if quote is None:
         abort(404)