fix(controller): disallow unauthorized users from rolling back releases

Because we did not check the user's permissions inside the view, a user
who did not have authorization could roll back an application's release
version.

Author: Matthew Fisher

controller/api/views.py

@@ -368,6 +368,7 @@ def rollback(self, request, *args, **kwargs):
         """
         try:
             app = get_object_or_404(models.App, id=self.kwargs['id'])
+            self.check_object_permissions(self.request, app)
             release = app.release_set.latest()
             version_to_rollback_to = release.version - 1
             if request.DATA.get('version'):