From 4a0e4b798e6ea3341b1bbc902b9e1e5f2c96692d Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Tue, 9 Dec 2008 10:14:09 +0000
Subject: Check view permissions before allowing view access to albums/photos.

---
 core/controllers/albums.php | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'core/controllers/albums.php')

diff --git a/core/controllers/albums.php b/core/controllers/albums.php
index e684fa6b..bba7fd6e 100644
--- a/core/controllers/albums.php
+++ b/core/controllers/albums.php
@@ -23,6 +23,10 @@ class Albums_Controller extends Items_Controller {
    *  @see Rest_Controller::_show($resource)
    */
   public function _show($item) {
+    if (!access::can("view", $item->id)) {
+      return Kohana::show_404();
+    }
+
     // @todo: these need to be pulled from the database
     $theme_name = "default";
     $page_size = 9;
-- 
cgit v1.2.3