liquid_feedback_frontend
changeset 1109:498d655dbc18
Added missing access control for member profile images
author | bsw |
---|---|
date | Mon Nov 10 18:52:33 2014 +0100 (2014-11-10) |
parents | 7f7142e949ee |
children | f41b584efaf4 |
files | app/main/_filter/21_auth.lua |
line diff
1.1 --- a/app/main/_filter/21_auth.lua Mon Nov 10 18:45:31 2014 +0100 1.2 +++ b/app/main/_filter/21_auth.lua Mon Nov 10 18:52:33 2014 +0100 1.3 @@ -47,6 +47,12 @@ 1.4 end 1.5 1.6 if app.session:has_access("authors_pseudonymous") then 1.7 + if module == "member_image" and view == "show" and param.get("image_type") == "avatar" then 1.8 + auth_needed = false 1.9 + end 1.10 +end 1.11 + 1.12 +if app.session:has_access("everything") then 1.13 if module == "member_image" and view == "show" then 1.14 auth_needed = false 1.15 end