Checking that a user exists now requires to be logged in, prevent use…

…r enumeration
matomo-org · Jan 8, 2014 · 11db442 · 11db442
1 parent 44eef27
commit 11db442
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/plugins/UsersManager/API.php b/plugins/UsersManager/API.php
@@ -499,6 +499,9 @@ public function deleteUser($userLogin)
      */
     public function userExists($userLogin)
     {
+        Piwik::checkUserIsNotAnonymous();
+        Piwik::checkUserHasSomeViewAccess();
+
         $count = Db::fetchOne("SELECT count(*)
 													FROM " . Common::prefixTable("user") . "
 													WHERE login = ?", $userLogin);