check for permissions in img.php. fixes #72

splitbrain · Jan 30, 2024 · 6fc6338 · 6fc6338
1 parent 66545d6
commit 6fc6338
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/img.php b/img.php
@@ -14,6 +14,7 @@
 /** @var helper_plugin_statistics $plugin */
 $plugin = plugin_load('helper', 'statistics');
 try {
+    if(!auth_ismanager()) throw new Exception('Access denied');
     $plugin->Graph()->render($_REQUEST['img'], $_REQUEST['f'], $_REQUEST['t'], $_REQUEST['s']);
 } catch(Exception $e) {
     $plugin->sendGIF(false);