#361

backend/app/controllers/gekanator_question_suggestions_controller.rb

@@ -1,9 +1,12 @@
 class GekanatorQuestionSuggestionsController < ApplicationController
   def create
-    return head :not_found unless current_user&.admin?
+    return head :unauthorized unless current_user
 
     game = GekanatorGame.find_by(id: params.require(:gekanator_game_id))
     return head :not_found unless game
+    if !current_user.admin? && game.user_id != current_user.id
+      return head :not_found
+    end
 
     suggestion = GekanatorQuestionSuggestion.new(
         gekanator_game: game,