unflag is admin only

1 files changed, 4 insertions, 2 deletions

diff --git a/src/main.lisp b/src/main.lisp
index e31aa76..27afeda 100644
--- a/src/main.lisp
+++ b/src/main.lisp
@@ -582,12 +582,14 @@ admin privileges are allowed to perform this action."
 (defendpoint* :put "/oneliner/:entry a-oneliner-id:/flag" ((token an-api-token)
                                                            (value a-boolean))
   (:auth t)
-  "Flag the oneliner for review."
+  "Flag / Unflag the oneliner for review."
   (when (and (lockedp entry) (not (adminp (api-contributor token))))
     (http-err 403))
   (if value 
       (flag-oneliner entry (api-contributor token))
-      (unflag-oneliner entry))
+      (if (adminp (api-contributor token))
+          (unflag-oneliner entry)
+          (http-err 403)))
   "true")
 
 (defendpoint* :get "/oneliners/all-flagged" ((limit an-int))