security issue fixed

smash/web/views.py

@@ -632,6 +632,7 @@ def appointment_edit_datetime(request, id):
 		form = AppointmentEditForm(instance=the_appointment)
 	return wrap_response(request, 'appointments/edit.html', {'form': form})
 
+@login_required
 def export_to_csv2(request, type="subjects"):
     #Create the HttpResponse object with the appropriate CSV header.
 	response = HttpResponse(content_type='text/csv')