disallow access to out-of-scope poll

2011-03-28 22:50:52 -04:00 · 2011-03-28 22:50:52 -04:00 · 908551ae3d
parent 2856982a1c
commit 908551ae3d
1 changed files with 12 additions and 0 deletions
--- a/plugins/Poll/showpoll.php
+++ b/plugins/Poll/showpoll.php
@ -76,6 +76,18 @@ class ShowPollAction extends ShownoticeAction
            throw new ClientException(_m('No such poll notice.'), 404);
        }

+        $cur = common_current_user();
+
+        if (!empty($cur)) {
+            $curProfile = $cur->getProfile();
+        } else {
+            $curProfile = null;
+        }
+
+        if (!$this->notice->inScope($curProfile)) {
+            throw new ClientException(_('Not available.'), 403);
+        }
+
        $this->user = User::staticGet('id', $this->poll->profile_id);

        if (empty($this->user)) {