Korisnici: dozvoljeno brisanje radnika i admin nalogu (ne samo superadminu); frontend ne navigira GET-om na POST-only rutu pri grešci bez redirekta

2026-07-31 11:19:33 +02:00
parent 5852c92d7e
commit 9ce1ee817d
2 changed files with 6 additions and 1 deletions
@@ -250,7 +250,7 @@ func (h *Handler) AdminPromeniUlogu(w http.ResponseWriter, r *http.Request) {
 // AdminObrisiKorisnika briše korisnika sa ulogom radnik
 func (h *Handler) AdminObrisiKorisnika(w http.ResponseWriter, r *http.Request) {
 	k := middleware.KorisnikIzKonteksta(r.Context())
-	if k == nil || k.Uloga != "superadmin" {
+	if !middleware.JeAdmin(k) {
 		http.Error(w, "Pristup odbijen", http.StatusForbidden)
 		return
 	}