diff --git a/gui.lua b/gui.lua
index 710adb0..d3306e2 100644
--- a/gui.lua
+++ b/gui.lua
@@ -100,6 +100,11 @@ end
 minetest.register_on_player_receive_fields(function(player, formname, fields)
 	if formname ~= FORMNAME then return end
 	local name = player:get_player_name()
+	if not minetest.check_player_privs(name, { ban=true }) then
+		minetest.log("warning",
+				"[xban2] Received fields from unauthorized user: "..name)
+		return
+	end
 	local state = get_state(name)
 	if fields.player then
 		local t = minetest.explode_textlist_event(fields.player)