diff --git a/ecrire/exec/articles_ortho.php b/ecrire/exec/articles_ortho.php index 0c4f9131d2797ae48ee4b76e2ea18c906650bc58..9d14e7a97a57cbfaa14ffc0d0817c1f01080e8b4 100644 --- a/ecrire/exec/articles_ortho.php +++ b/ecrire/exec/articles_ortho.php @@ -15,6 +15,7 @@ if (!defined("_ECRIRE_INC_VERSION")) return; include_spip('inc/presentation'); include_spip('inc/distant'); include_spip('inc/ortho'); +include_spip('inc/autoriser'); // http://doc.spip.org/@exec_articles_ortho_dist function exec_articles_ortho_dist() @@ -42,6 +43,7 @@ function exec_articles_ortho_dist() // Lire l'article // $id_article = intval($id_article); + if (!autoriser('voir', 'article', $id_article)) die('interdit'); $result = spip_query("SELECT * FROM spip_articles WHERE id_article='$id_article'"); diff --git a/ecrire/inc/autoriser.php b/ecrire/inc/autoriser.php index 0b765d6188a68bca13152b9c809450ff82122420..c157bff13b4eeb83b1de6db620eb751f09d01d31 100644 --- a/ecrire/inc/autoriser.php +++ b/ecrire/inc/autoriser.php @@ -150,7 +150,8 @@ function autoriser_voir_dist($faire, $type, $id, $qui, $opt) { $s = spip_query( "SELECT statut FROM spip_articles WHERE id_article="._q($id)); $r = spip_fetch_array($s); - return in_array($r['statut'], array('prop', 'publie')) + return + in_array($r['statut'], array('prop', 'publie')) OR spip_num_rows(auteurs_article($id, "id_auteur=".$qui['id_auteur'])); }