don't show upload button for users

cps/templates/layout.html

@@ -63,6 +63,7 @@
           </ul>
           <ul class="nav navbar-nav navbar-right" id="main-nav">
             {% if g.user.is_authenticated() %}
+              {% if g.user.role %}
                   <li>
                     <form id="form-upload" class="navbar-form" action="{{ url_for('upload') }}" method="post" enctype="multipart/form-data">
                       <div class="form-group">
@@ -70,6 +71,7 @@
                       </div>
                     </form>
                   </li>
+              {% endif %}
               {% if g.user.role %}
                 <li><a href="{{url_for('user_list')}}"><span class="glyphicon glyphicon-dashboard"></span> Admin</a></li>
               {% endif %}

cps/web.py

@@ -749,6 +749,7 @@ def edit_book(book_id):
 
 @app.route("/upload", methods = ["GET", "POST"])
 @login_required
+@admin_required
 def upload():
     ## create the function for sorting...
     db.session.connection().connection.connection.create_function("title_sort",1,db.title_sort)