From e23af9e58c4a3cd01b63a0ff519d92183f429db1 Mon Sep 17 00:00:00 2001
From: Simon Rettberg
Date: Tue, 10 Apr 2018 15:46:43 +0200
Subject: [dozmod] Require explicit view permission for user list

---
 modules-available/dozmod/pages/users.inc.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules-available/dozmod/pages/users.inc.php b/modules-available/dozmod/pages/users.inc.php
index 0c958feb..23457ca6 100644
--- a/modules-available/dozmod/pages/users.inc.php
+++ b/modules-available/dozmod/pages/users.inc.php
@@ -5,7 +5,8 @@ class SubPage
 
 	public static function doPreprocess()
 	{
-
+		// Currently there's only one view, actions are ajax
+		User::assertPermission('users.view');
 	}
 
 	public static function doRender()
-- 
cgit v1.2.3-55-g7522