user-update: forbid regular user to update 'enable-request-logging'

restapi/handlers/user-update.go

@@ -38,8 +38,11 @@
 	q := squirrel.Update(models.UserDBTable).
 		Set(models.UserinfoFirstnameColumn, user.Firstname).
 		Set(models.UserinfoLastnameColumn, user.Lastname).
-		Set(models.UserinfoUsernameColumn, user.Username).
-		Set(models.UserinfoEnableRequestLoggingColumn, user.EnableRequestLogging).
+		Set(models.UserinfoUsernameColumn, user.Username)
+	if isAdmin {
+		q = q.Set(models.UserinfoEnableRequestLoggingColumn, user.EnableRequestLogging)
+	}
+	q = q.
 		Where(squirrel.Eq{models.UserinfoUsernameColumn: username}).
 		Suffix("RETURNING " + strings.Join(models.UserinfoColumns, ","))