prevent users from seeing our webhook responses

abhigyanghosh30 · Oct 8, 2023 · 868fddb · 868fddb
1 parent c2a1f01
commit 868fddb
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/webapp/shop/cred/views.py b/webapp/shop/cred/views.py
@@ -630,6 +630,7 @@ def cred_beta_activation(**_):
 
 
 @shop_decorator(area="cred", permission="user", response="json")
+@canonical_staff()
 def get_filtered_webhook_responses(trueability_api, **kwargs):
     ability_screen_id = flask.request.args.get("ability_screen_id", None)
     page = flask.request.args.get("page", 1)
@@ -668,6 +669,7 @@ def get_filtered_webhook_responses(trueability_api, **kwargs):
 
 
 @shop_decorator(area="cred", permission="user", response="json")
+@canonical_staff()
 def get_webhook_response(trueability_api, **kwargs):
     webhook_id = flask.request.args.get("webhook_id", None)
     webhook_responses = trueability_api.get_webhook_response(