diff --git a/tailbone/api/common.py b/tailbone/api/common.py
index 0b752adf..0552b68d 100644
--- a/tailbone/api/common.py
+++ b/tailbone/api/common.py
@@ -119,7 +119,8 @@ class CommonView(APIView):
# feedback
feedback = Service(name='feedback', path='/feedback')
- feedback.add_view('POST', 'feedback', klass=cls)
+ feedback.add_view('POST', 'feedback', klass=cls,
+ permission='common.feedback')
config.add_cornice_service(feedback)
diff --git a/tailbone/templates/base.mako b/tailbone/templates/base.mako
index aea0c0e5..daa60e2d 100644
--- a/tailbone/templates/base.mako
+++ b/tailbone/templates/base.mako
@@ -71,7 +71,9 @@
% if help_url is not Undefined and help_url:
${h.link_to("Help", help_url, target='_blank', class_='button')}
% endif
-
+ % if request.has_perm('common.feedback'):
+
+ % endif
% if expose_theme_picker and request.has_perm('common.change_app_theme'):
diff --git a/tailbone/templates/themes/falafel/base.mako b/tailbone/templates/themes/falafel/base.mako
index 24f3acf5..713d9547 100644
--- a/tailbone/templates/themes/falafel/base.mako
+++ b/tailbone/templates/themes/falafel/base.mako
@@ -330,9 +330,11 @@
% endif
## Feedback Button / Dialog
-
-
+ % if request.has_perm('common.feedback'):
+
+
+ % endif
diff --git a/tailbone/views/common.py b/tailbone/views/common.py
index 8aced214..dd02e614 100644
--- a/tailbone/views/common.py
+++ b/tailbone/views/common.py
@@ -2,7 +2,7 @@
################################################################################
#
# Rattail -- Retail Software Framework
-# Copyright © 2010-2019 Lance Edgar
+# Copyright © 2010-2020 Lance Edgar
#
# This file is part of Rattail.
#
@@ -229,10 +229,14 @@ class CommonView(View):
config.add_view(cls, attr='change_theme', route_name='change_theme')
# feedback
+ config.add_tailbone_permission('common', 'common.feedback',
+ "Send user feedback (to admins) about the app")
config.add_route('feedback', '/feedback', request_method='POST')
- config.add_view(cls, attr='feedback', route_name='feedback', renderer='json')
+ config.add_view(cls, attr='feedback', route_name='feedback',
+ renderer='json', permission='common.feedback')
config.add_route('mobile.feedback', '/mobile/feedback', request_method='POST')
- config.add_view(cls, attr='mobile_feedback', route_name='mobile.feedback', renderer='json')
+ config.add_view(cls, attr='mobile_feedback', route_name='mobile.feedback',
+ renderer='json', permission='common.feedback')
# consume batch ID
config.add_tailbone_permission('common', 'common.consume_batch_id',