Non-authenticated AJAX actions are only supported in handlers, not hooks

horde · Nov 14, 2013 · e894825 · e894825
1 parent 1b8c968
commit e894825
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/framework/Core/lib/Horde/Core/Ajax/Application.php b/framework/Core/lib/Horde/Core/Ajax/Application.php
@@ -82,11 +82,13 @@ public function __construct($app, Horde_Variables $vars, $action = null,
 
         $ob = $this->_getHandler();
 
+        /* Non-authenticated actions MUST occur in a handler. */
+        if (!$ob && !$registry->currentProcessAuth()) {
+            throw new Horde_Exception('Accessing AJAX action without being authenticated.');
+        }
+
         /* Check authentication/token. */
         if ($ob && !$ob->external($action)) {
-            if (!$registry->currentProcessAuth()) {
-                throw new Horde_Exception('Accessing AJAX action without being authenticated.');
-            }
             $session->checkToken($token);
         }