From 257951ab520f6bc8146f5a9132b85e59f0c7a318 Mon Sep 17 00:00:00 2001
From: Mathis Kral <mathis_tiberius.kral@mailbox.tu-dresden.de>
Date: Wed, 15 Nov 2023 18:17:27 +0100
Subject: [PATCH] Add sec:authorize to catalog and orders

Closes #22
---
 src/main/resources/templates/catalog.html | 4 ++--
 src/main/resources/templates/orders.html  | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/main/resources/templates/catalog.html b/src/main/resources/templates/catalog.html
index 4fc3f15..c26e9cd 100644
--- a/src/main/resources/templates/catalog.html
+++ b/src/main/resources/templates/catalog.html
@@ -30,7 +30,7 @@
 							</ul>
 						</td>
 						<td th:text="${catalogEntry.getTotalCost()}">
-						<td>
+						<td sec:authorize="hasRole('ADMIN')">
 							<form method="post" th:action="@{/catalog/remove}">
 								<input type="hidden" name="catalogEntryID" th:value="${catalogEntry.getId()}">
 								<button type="submit">Entfernen</button>
@@ -40,7 +40,7 @@
 				</table>
 			</div>
 
-			<div>
+			<div sec:authorize="hasRole('ADMIN')">
 				<form th:action="@{/catalog_editor}">
 					<button type="submit">Hinzufügen</button>
 				</form>
diff --git a/src/main/resources/templates/orders.html b/src/main/resources/templates/orders.html
index 2a6d065..3fda4fb 100644
--- a/src/main/resources/templates/orders.html
+++ b/src/main/resources/templates/orders.html
@@ -42,7 +42,7 @@
 							<th:block th:text="${order.getTotalCost()}"/>
 							<th:block th:text="€"/>
 						</td>
-						<td>
+						<td sec:authorize="hasRole('ADMIN')">
 							<form method="post" th:action="@{/orders/remove}">
 								<input type="hidden" name="orderID" value="0" th:value="${order.getId()}"/>
 								<input type="submit" value="remove" th:value="Entfernen"/>