prevent non authority users from changing the state on updates

1 files changed, 9 insertions, 0 deletions

diff --git a/perllib/FixMyStreet/App/Controller/Report/Update.pm b/perllib/FixMyStreet/App/Controller/Report/Update.pm
index 88b53494b..02d111d9f 100644
--- a/perllib/FixMyStreet/App/Controller/Report/Update.pm
+++ b/perllib/FixMyStreet/App/Controller/Report/Update.pm
@@ -180,6 +180,15 @@ return false.
 sub check_for_errors : Private {
     my ( $self, $c ) = @_;
 
+    # they have to be an authority user to update the state
+    if ( $c->req->param('state') ) {
+        unless ( $c->user && $c->user->from_authority ) {
+            $c->stash->{errors} ||= [];
+            push @{ $c->stash->{errors} }, _('There was a problem with your update. Please try again.');
+            return;
+        }
+    }
+
     # let the model check for errors
     my %field_errors = (
         %{ $c->stash->{update_user}->check_for_errors },