| Index: trunk/phase3/img_auth.php |
| — | — | @@ -55,6 +55,10 @@ |
| 56 | 56 | wfDebugLog( 'img_auth', "Unable to construct a valid Title from `{$name}`" ); |
| 57 | 57 | wfForbidden(); |
| 58 | 58 | } |
| | 59 | +if( !$title->userCanRead() ) { |
| | 60 | + wfDebugLog( 'img_auth', "User does not have access to read `{$name}`" ); |
| | 61 | + wfForbidden(); |
| | 62 | +} |
| 59 | 63 | $title = $title->getPrefixedText(); |
| 60 | 64 | |
| 61 | 65 | // Check the whitelist if needed |
| Index: trunk/phase3/RELEASE-NOTES |
| — | — | @@ -223,6 +223,7 @@ |
| 224 | 224 | * (bug 11242) Check for MySQL storage engines during installation now checks |
| 225 | 225 | whether the engines are actually available |
| 226 | 226 | * (bug 19390) Omit the "printable version" link on the printable version |
| | 227 | +* (bug 18394) img_auth.php now respects userCan |
| 227 | 228 | |
| 228 | 229 | == API changes in 1.16 == |
| 229 | 230 | |