Find the authorization flaw in this generated order view.
Python
@login_required
def order_detail(request, order_id):
order = get_object_or_404(Order, pk=order_id)
return JsonResponse(
{
"reference": order.reference,
"shipping_address": order.shipping_address,
}
)