hotfix: access to book.settings

app/views/book.py

@@ -197,6 +197,10 @@ def interpretation_view(
 @login_required
 def settings(book_id: int):
     book: m.Book = db.session.get(m.Book, book_id)
+    if book.owner != current_user:
+        log(log.INFO, "User: [%s] is not owner of book: [%s]", current_user, book)
+        flash("You are not owner of this book!", "danger")
+        return redirect(url_for("book.my_books"))
 
     return render_template(
         "book/settings.html", book=book, roles=m.BookContributor.Roles