|
|
@@ -100,7 +100,7 @@ public class PortfolioService {
|
|
|
log.info("Updating portfolio [{}]", id);
|
|
|
PortfolioEntity toUpdate = repository.findById(id).orElseThrow(() -> new NotFoundException("Failed to update portfolio with id: " + id));
|
|
|
|
|
|
- if (!Objects.equals(toUpdate.getUser(), UserContextHolder.get().getId()) || UserContextHolder.isAdmin()) {
|
|
|
+ if (!Objects.equals(toUpdate.getUser(), UserContextHolder.get().getId()) && !UserContextHolder.isAdmin()) {
|
|
|
throw new UnauthorizedException("You do not have permission to update portfolio");
|
|
|
}
|
|
|
|