github/reddit
1
1
Fork 0
mirror of https://github.com/reddit-archive/reddit.git synced 2026-04-27 03:00:12 -04:00
Code Issues Packages Projects Releases Wiki Activity

/gold: Ensure user should be allowed to see a comment.

Browse Source 
This fixes an information disclosure vulnerability reported by Jordan
Milne (/u/largenocream).
This commit is contained in:
Neil Williams
2014-02-14 14:18:27 -08:00
parent f8bf988006
commit 240140ee59
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
r2/r2/controllers/front.py
View File

@@ -1494,8 +1494,8 @@ class FormsController(RedditController):
if comment:
comment_sr = Subreddit._byID(comment.sr_id, data=True)
if (comment._deleted or
comment._spam or
if (comment._deleted or comment._spam or
not comment_sr.can_view(c.user) or
not comment_sr.allow_comment_gilding):
comment = None