Unauthorized read, post and delete messages in project discussion

[xiaoyinl]

For example, if user1 creates a project and invites some users into this project. User2 is not in this project. If user2 visits http://127.0.0.1/librarian/discussion.php?project=1 directly, he gets "Error! You are not authorized to see this project." But if user2 visits http://127.0.0.1/librarian/ajaxdiscussion.php?project=1&read=1, he is able to read the messages for this project. Similarly user2 can use project=1&delete=1 to delete all messages, and project=1&newmessage=... to post new messages.

The bug is in ajaxdiscussion.php. Unlike discussion.php, ajaxdiscussion.php doesn't check if the current user is in the specified project.