Check view permissions before allowing view access to albums/photos.

3 files changed, 10 insertions, 10 deletions

diff --git a/core/controllers/albums.php b/core/controllers/albums.php
index e684fa6b..bba7fd6e 100644
--- a/core/controllers/albums.php
+++ b/core/controllers/albums.php
@@ -23,6 +23,10 @@ class Albums_Controller extends Items_Controller {
    *  @see Rest_Controller::_show($resource)
    */
   public function _show($item) {
+    if (!access::can("view", $item->id)) {
+      return Kohana::show_404();
+    }
+
     // @todo: these need to be pulled from the database
     $theme_name = "default";
     $page_size = 9;
diff --git a/core/controllers/photos.php b/core/controllers/photos.php
index 7a599f4b..8b3e81fc 100644
--- a/core/controllers/photos.php
+++ b/core/controllers/photos.php
@@ -23,6 +23,10 @@ class Photos_Controller extends Items_Controller {
    *  @see Rest_Controller::_show($resource)
    */
   public function _show($item) {
+    if (!access::can("view", $item->id)) {
+      return Kohana::show_404();
+    }
+
     // @todo: this needs to be data-driven
     $template = new Theme_View("page.html", "photo", "default");
 
diff --git a/core/controllers/rest.php b/core/controllers/rest.php
index c7429f5d..c10bbcdb 100644
--- a/core/controllers/rest.php
+++ b/core/controllers/rest.php
@@ -81,22 +81,14 @@ abstract class REST_Controller extends Controller {
       return $this->_index();
     }
 
-    // @todo this needs security checks
-    $id = $function;
-    $resource = ORM::factory($this->resource_type, $id);
+    $resource = ORM::factory($this->resource_type, $function);
     if (!$resource->loaded && $request_method != "post") {
       return Kohana::show_404();
     }
 
     switch ($request_method) {
     case "get":
-      $this->_show($resource);
-
-      if (Session::instance()->get("use_profiler", false)) {
-        $profiler = new Profiler();
-        $profiler->render();
-      }
-      return;
+      return $this->_show($resource);
 
     case "put":
       return $this->_update($resource);