diff --git a/pylons_app/controllers/shortlog.py b/pylons_app/controllers/shortlog.py
--- a/pylons_app/controllers/shortlog.py
+++ b/pylons_app/controllers/shortlog.py
@@ -23,17 +23,18 @@ shortlog controller for pylons
 @author: marcink
 """
 from pylons import tmpl_context as c, request
-from pylons_app.lib.auth import LoginRequired
+from pylons_app.lib.auth import LoginRequired, HasRepoPermissionAnyDecorator
 from pylons_app.lib.base import BaseController, render
 from pylons_app.model.hg_model import HgModel
 from webhelpers.paginate import Page
 import logging
-
 log = logging.getLogger(__name__)
 
 class ShortlogController(BaseController):
     
     @LoginRequired()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')       
     def __before__(self):
         super(ShortlogController, self).__before__()