Don't expose members of an item that are not viewable by the end user.

This leaks item ids, but no other information about the item.  Fixes
ticket #1292.

1 files changed, 1 insertions, 1 deletions

diff --git a/modules/gallery/helpers/items_rest.php b/modules/gallery/helpers/items_rest.php
index 9cca9a54..f0b68d63 100644
--- a/modules/gallery/helpers/items_rest.php
+++ b/modules/gallery/helpers/items_rest.php
@@ -80,7 +80,7 @@ class items_rest_Core {
                        "relationships" => rest::relationships("item", $item));
     if ($item->type == "album") {
       $members = array();
-      foreach ($item->children() as $child) {
+      foreach ($item->viewable()->children() as $child) {
         $members[] = rest::url("item", $child);
       }
       $item_rest["members"] = $members;