access::allow/deny/reset functions will now throw an exception if you

don't pass in a Group_Model as the argument.  This prevents us from
setting permissions on the wrong group by accidentally passing in a
User_Model.

1 files changed, 4 insertions, 1 deletions

diff --git a/core/helpers/access.php b/core/helpers/access.php
index a2b3a761..00c88f12 100644
--- a/core/helpers/access.php
+++ b/core/helpers/access.php
@@ -184,7 +184,10 @@ class access_Core {
    * @param  Item_Model  $item
    * @param  boolean     $value
    */
-  private static function _set($group, $perm_name, $album, $value) {
+  private static function _set(Controller $group, $perm_name, $album, $value) {
+    if (get_class($group) != "Group_Model") {
+      throw new Exception("@todo PERMISSIONS_ONLY_WORK_ON_GROUPS");
+    }
     if (!$album->loaded) {
       throw new Exception("@todo INVALID_ALBUM $album->id");
     }