Protect API endpoint for showing paid orders.

1 files changed, 1 insertions, 1 deletions

diff --git a/server/routes/api.js b/server/routes/api.js
index cf1d2d6..b680b70 100644
--- a/server/routes/api.js
+++ b/server/routes/api.js
@@ -17,7 +17,7 @@ router.post('/products', isAuth, isAdmin, upload.single('image'), productsContro
 router.patch('/products/:id', isAuth, isAdmin, upload.single('image'), productsController.update);
 router.delete('/products/:id', isAuth, isAdmin, productsController.destroy);
 
-router.get('/transactions/paid', transactionController.showPaid);
+router.get('/transactions/paid', isAuth, isAdmin, transactionController.showPaid);
 router.post('/transactions/setup', transactionController.setup);
 router.post('/transactions/capture', transactionController.capture);