'scalar --get_set_init' => [ qw(predefined_texts js picture) ],
 );
 
+__PACKAGE__->run_before('check_auth');
 __PACKAGE__->run_before('load_requirement_spec_text_block', only => [qw(ajax_edit ajax_update ajax_delete ajax_flag dragged_and_dropped ajax_copy ajax_add_picture)]);
 
 #
 # filters
 #
 
+sub check_auth {
+  my ($self) = @_;
+  $::auth->assert('requirement_spec_edit');
+}
+
 sub load_requirement_spec_text_block {
   my ($self) = @_;
   $self->text_block(SL::DB::RequirementSpecTextBlock->new(id => $::form->{id})->load || die "No such requirement spec text block");