Added access check - not really necesssary because we're only doing a

redirect, but it's nice to be consistent.  Follow-on for #1837.

1 files changed, 1 insertions, 0 deletions

diff --git a/modules/image_block/controllers/image_block.php b/modules/image_block/controllers/image_block.php
index 94024b3b..4956c08d 100644
--- a/modules/image_block/controllers/image_block.php
+++ b/modules/image_block/controllers/image_block.php
@@ -20,6 +20,7 @@
 class Image_Block_Controller extends Controller {
   public function random($item_id) {
     $item = ORM::factory("item", $item_id);
+    access::required("view", $item);
     item::set_display_context_callback("Albums_Controller::get_display_context");
     url::redirect($item->abs_url());
   }