Always call check_access, even if a user does not exist.

ckan · Jan 27, 2017 · 338f1b1 · 338f1b1
1 parent 1d0f7f8
commit 338f1b1
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/ckan/logic/action/get.py b/ckan/logic/action/get.py
@@ -1493,6 +1493,8 @@ def user_show(context, data_dict):
     :rtype: dictionary
 
     '''
+    _check_access('user_show', context, data_dict)
+
     model = context['model']
 
     id = data_dict.get('id', None)
@@ -1507,8 +1509,6 @@ def user_show(context, data_dict):
     else:
         raise NotFound
 
-    _check_access('user_show', context, data_dict)
-
     # include private and draft datasets?
     requester = context.get('user')
     sysadmin = False