From 113a55815843e91a17d964f8864d2075052c6e19 Mon Sep 17 00:00:00 2001
From: rulingcom <orbit@rulingcom.com>
Date: Mon, 17 Aug 2026 15:26:26 +0800
Subject: [PATCH] Add permission checks

---
 app/controllers/admin/personal_plugin_fields_controller.rb | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/app/controllers/admin/personal_plugin_fields_controller.rb b/app/controllers/admin/personal_plugin_fields_controller.rb
index f50d947..5e67f8f 100644
--- a/app/controllers/admin/personal_plugin_fields_controller.rb
+++ b/app/controllers/admin/personal_plugin_fields_controller.rb
@@ -2,6 +2,7 @@ class Admin::PersonalPluginFieldsController < OrbitMemberController
 	require 'fileutils'
 	include Admin::PersonalPluginFieldsHelper
 	before_action :set_personal_plugin_field, only: [:show, :edit , :update, :destroy, :fields_setting, :update_fields_setting,:generate_plugin]
+        before_action :check_system_admin_rights
 
 	def index
 		@personal_plugin_fields = PersonalPluginField.order_by(:created_at=>'desc').page(params[:page]).per(10)
@@ -948,6 +949,10 @@ class Admin::PersonalPluginFieldsController < OrbitMemberController
 		end
 	end
 	private
+        def check_system_admin_rights  
+	  user_has_rights = (current_user.is_admin? rescue false)
+	  render_401 if !user_has_rights
+	end
 	def personal_plugin_field_params
 		personal_plugin_field_params = params.require(:personal_plugin_field).permit! rescue {}
 		if personal_plugin_field_params[:related_modal_name].nil?
@@ -984,4 +989,4 @@ class Admin::PersonalPluginFieldsController < OrbitMemberController
 		%x(kill -s USR2 `cat tmp/pids/unicorn.pid`)
 		sleep 2
 	end
-end
\ No newline at end of file
+end