diff --git a/e107_admin/image.php b/e107_admin/image.php index e872be907..680238bd9 100644 --- a/e107_admin/image.php +++ b/e107_admin/image.php @@ -18,7 +18,7 @@ if (!defined('e107_INIT')) require_once("../class2.php"); } -if (!getperms("A")) +if (!getperms("A") && ($_GET['action'] != 'dialog')) { header("location:".e_HTTP."index.php"); exit; @@ -458,8 +458,10 @@ class media_admin_ui extends e_admin_ui $this->updateSettings(); } - if($this->getQuery('mode') == 'dialog') + if($this->getQuery('mode') == 'dialog')//TODO Check this actually does something, as it was changed to 'action'. { + if(!ADMIN){ exit; } + $cat = $_GET['for']; if(!isset($this->cats[$cat])) { @@ -574,6 +576,9 @@ class media_admin_ui extends e_admin_ui function uploadPage() { + if(!ADMIN){ exit; } //TODO check for upload-access in perms. + + $text = '

No HTML5 support.

'; @@ -702,7 +707,7 @@ class media_admin_ui extends e_admin_ui $text .= "