Ensure edit events from visual editor is only processed in debug mode

Author: wwwillchen

mesop/server/server.py

@@ -105,7 +105,9 @@ def generate_data(ui_request: pb.UiRequest) -> Generator[str, None, None]:
         # one's local computer
         if request.remote_addr not in LOCALHOSTS:
           abort(403)  # Throws a Forbidden Error
-
+        # Visual editor should only be enabled in debug mode.
+        if not runtime().debug_mode:
+          abort(403)  # Throws a Forbidden Error
         handle_editor_event(ui_request.editor_event)
         yield "data: <stream_end>\n\n"
       else: