Hi all,

Inside function blogapi_get_post($req_params), it should check userId

$node = node_load(array('nid' => $params[0]));

+ if (!$node || $node->uid != $user->uid) {
+ return blogapi_error(message_na());
+ }

$blog = _blogapi_get_post($node, true);

Regards,

yysun
http://www.wbeditor.com

Comments

yysun’s picture

yysun commented

maybe it should use

return blogapi_error(message_access());

yysun’s picture

yysun commented

Maybe my last post set this issue to be "fixed". But it's not yet. Checked the CVS.

yysun
http://www.wbeditor.com

Prometheus6’s picture

Prometheus6 commented

The user is validated before the call to node_load()

$user = blogapi_validate_user($params[1], $params[2]);
if (!$user->uid) {
  return blogapi_error($user);
}

$node = node_load(array('nid' => $params[0]));