locking down put endpoint for orgs

david-rocca · david-rocca · commit da6f9204284b · 2026-02-18T10:30:32.000-05:00
diff --git a/src/controller/org.controller/index.js b/src/controller/org.controller/index.js
@@ -639,6 +639,7 @@ router.put('/registry/org/:shortname',
   */
   mw.useRegistry(),
   mw.validateUser,
+  mw.onlySecretariat,
   parseError,
   parsePutParams,
   registryOrgController.UPDATE_ORG
