check that state is permitted

1 files changed, 8 insertions, 1 deletions

diff --git a/perllib/FixMyStreet/App/Controller/Report/Update.pm b/perllib/FixMyStreet/App/Controller/Report/Update.pm
index 41bc3a4bd..5421385fb 100644
--- a/perllib/FixMyStreet/App/Controller/Report/Update.pm
+++ b/perllib/FixMyStreet/App/Controller/Report/Update.pm
@@ -181,11 +181,18 @@ sub check_for_errors : Private {
 
     # they have to be an authority user to update the state
     if ( $c->req->param('state') ) {
-        unless ( $c->user && $c->user->from_authority ) {
+        my $error = 0;
+        $error = 1 unless $c->user && $c->user->from_authority;
+
+        my $state = $c->req->param('state');
+        $error = 1 unless ( grep { $state eq $_ } ( qw/closed fixed investigating planned/, 'in progress', 'fixed', 'fixed - user', 'fixed - council' ) );
+
+        if ( $error ) {
             $c->stash->{errors} ||= [];
             push @{ $c->stash->{errors} }, _('There was a problem with your update. Please try again.');
             return;
         }
+
     }
 
     # let the model check for errors