Fixes a data disclosure issue introduced in r3941.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@4535 e93f8b46-1217-0410-a6f0-8f06a7374b81
2010-12-18 17:11:41 +00:00
parent 525656a490
commit 93847ae337
2 changed files with 9 additions and 2 deletions
@@ -19,6 +19,7 @@ class JournalsController < ApplicationController
  before_filter :find_journal, :only => [:edit]
  before_filter :find_issue, :only => [:new]
  before_filter :find_optional_project, :only => [:index]
+  before_filter :authorize, :only => [:new, :edit]
  accept_key_auth :index

  helper :issues