deepcrayon/lila
deepcrayon/lila
1
0
Fork 0
Code Releases Activity

cheater hunders can always see coach data

Browse source
This commit is contained in:
Thibault Duplessis 2015-07-19 22:11:10 +02:00
parent a308224bf8
commit e3240f22a0
1 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
app/controllers/Coach.scala
View file

@ -2,8 +2,8 @@ package controllers
import lila.api.Context
import lila.app._
import play.api.mvc.Result
import play.api.libs.json.Json
import play.api.mvc.Result
import views._
object Coach extends LilaController {
@ -47,8 +47,9 @@ object Coach extends LilaController {
lila.user.UserRepo named username flatMap {
case None => notFound
case Some(u) => env.share.grant(u, ctx.me) flatMap {
case true => f(u)
case false => fuccess(Forbidden(html.coach.forbidden(u)))
case true => f(u)
case false if isGranted(_.UserSpy) => f(u)
case false => fuccess(Forbidden(html.coach.forbidden(u)))
}
}
}