Fix security pattern. We can't successfully call access::can unless the item is loaded.

1 files changed, 2 insertions, 5 deletions

diff --git a/modules/tag/controllers/tags.php b/modules/tag/controllers/tags.php
index aba8ce32..625f1ac6 100644
--- a/modules/tag/controllers/tags.php
+++ b/modules/tag/controllers/tags.php
@@ -54,11 +54,8 @@ class Tags_Controller extends REST_Controller {
     $form = tag::get_add_form($this->input->post('item_id'));
     if ($form->validate()) {
       $item = ORM::factory("item", $this->input->post("item_id"));
-      if (access::can("edit", $item)) {
-        if ($item->loaded) {
-          tag::add($item, $this->input->post("tag_name"));
-        }
-
+      if ($item->loaded && access::can("edit", $item)) {
+        tag::add($item, $this->input->post("tag_name"));
         rest::http_status(rest::CREATED);
         rest::http_location(url::site("tags/{$tag->id}"));
       } else {