From 4b1035632562964a901eb458c5c5cf5b1e0b0e64 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ivar=20Conradi=20=C3=98sthus?= <ivarconr@gmail.com>
Date: Thu, 22 Apr 2021 12:13:41 +0200
Subject: [PATCH] fix: only ADMIN can list all users

---
 src/lib/routes/admin-api/user-admin.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/routes/admin-api/user-admin.ts b/src/lib/routes/admin-api/user-admin.ts
index 2567527b52..462284716c 100644
--- a/src/lib/routes/admin-api/user-admin.ts
+++ b/src/lib/routes/admin-api/user-admin.ts
@@ -21,7 +21,7 @@ export default class UserAdminController extends Controller {
         this.accessService = accessService;
         this.logger = config.getLogger('routes/user-controller.ts');
 
-        this.get('/', this.getUsers);
+        this.get('/', this.getUsers, ADMIN);
         this.get('/search', this.search);
         this.post('/', this.createUser, ADMIN);
         this.post('/validate-password', this.validatePassword);