api: fix panic if anonymous user request admin API

Add sign in check before check user account level

diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go
index 4fac550e82a8404d7d2bdc687c1fa8461b1abab7..a13a1e6885020dde587b1f24228d676e801aeee7 100644 (file)
--- a/routers/api/v1/api.go
+++ b/routers/api/v1/api.go
@@ -103,7 +103,7 @@ func ReqBasicAuth() macaron.Handler {
 
 func ReqAdmin() macaron.Handler {
        return func(ctx *context.Context) {
-               if !ctx.User.IsAdmin {
+               if !ctx.IsSigned || !ctx.User.IsAdmin {
                        ctx.Error(403)
                        return
                }