clean the links and require authorization before showing admin pages

1 files changed, 3 insertions, 0 deletions

diff --git a/core/controllers/admin.php b/core/controllers/admin.php
index 5fadd885..4824ce93 100644
--- a/core/controllers/admin.php
+++ b/core/controllers/admin.php
@@ -19,6 +19,9 @@
  */
 class Admin_Controller extends Controller {
   public function dashboard() {
+    if (!(user::active()->admin)) {
+      throw new Exception("Unauthorized", 401);      
+    }
     // giving default is probably overkill
     $theme_name = module::get_var("core", "active_admin_theme", "default_admin");
     // For now, in order not to duplicate js and css, keep the regular ("item")