fix: only allow setting ticket for supporter group

diff --git a/src/org/cacert/gigi/pages/admin/support/SupportEnterTicketPage.java b/src/org/cacert/gigi/pages/admin/support/SupportEnterTicketPage.java
index 563ca18a83ea64c45cc28bbe0ca746aa160471f8..eb1cfcabf3d19a5ab8bddad35296592935491ed3 100644 (file)
--- a/src/org/cacert/gigi/pages/admin/support/SupportEnterTicketPage.java
+++ b/src/org/cacert/gigi/pages/admin/support/SupportEnterTicketPage.java
@@ -7,9 +7,11 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import org.cacert.gigi.GigiApiException;
+import org.cacert.gigi.dbObjects.Group;
 import org.cacert.gigi.output.template.Form;
 import org.cacert.gigi.pages.LoginPage;
 import org.cacert.gigi.pages.Page;
+import org.cacert.gigi.util.AuthorizationContext;
 
 public class SupportEnterTicketPage extends Page {
 
@@ -44,4 +46,9 @@ public class SupportEnterTicketPage extends Page {
         new SupportEnterTicketForm(req).output(resp.getWriter(), getLanguage(req), vars);
     }
 
+    @Override
+    public boolean isPermitted(AuthorizationContext ac) {
+        return ac != null && ac.isInGroup(Group.SUPPORTER);
+    }
+
 }