Added permission check in PreorderApi for preorderaddressreporting

application/Api/v1/AddressdbApicontroller.php

@@ -71,7 +71,7 @@ class AddressdbApicontroller extends mfBaseApicontroller {
           
         }
       }
-
+      
     } else {
     
       $campaignApiusers = PreordercampaignApiuserModel::search(["worker_id" => $this->me->id]);

application/Api/v1/PreorderApicontroller.php

@@ -28,6 +28,11 @@ class PreorderApicontroller extends mfBaseApicontroller {
   }
   
   protected function authenticated() {
+    
+    if($this->me->is("preorderaddressreporting")) {
+      return mfResponse::Forbidden();
+    }
+    
     $campaignApiusers = PreordercampaignApiuserModel::search(["worker_id" => $this->me->id]);
     
     foreach($campaignApiusers as $campaignApiuser) {