diff options
| -rw-r--r-- | routers/web/user/home.go | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/routers/web/user/home.go b/routers/web/user/home.go index 3a7630fb32..1dfbafafa7 100644 --- a/routers/web/user/home.go +++ b/routers/web/user/home.go @@ -821,6 +821,11 @@ func UsernameSubRoute(ctx *context.Context) { reloadParam := func(suffix string) (success bool) { ctx.SetParams("username", strings.TrimSuffix(username, suffix)) context_service.UserAssignmentWeb()(ctx) + // check view permissions + if !user_model.IsUserVisibleToViewer(ctx, ctx.ContextUser, ctx.Doer) { + ctx.NotFound("user", fmt.Errorf(ctx.ContextUser.Name)) + return false + } return !ctx.Written() } switch { |