For good measure, don't return autocomplete results when not logged in.

diff --git a/plugins/Autocomplete/autocomplete.php b/plugins/Autocomplete/autocomplete.php
index c4b30d264d5d3d23c0a3afade9d568cce65395fb..c92002245fba467c457f866c2e10e9406407c568 100644 (file)
--- a/plugins/Autocomplete/autocomplete.php
+++ b/plugins/Autocomplete/autocomplete.php
@@ -87,7 +87,15 @@ class AutocompleteAction extends Action
 
     function prepare($args)
     {
+        // If we die, show short error messages.
+        StatusNet::setApi(true);
+
         parent::prepare($args);
+
+        $cur = common_current_user();
+        if (!$cur) {
+            throw new ClientException('Access forbidden', true);
+        }
         $this->groups=array();
         $this->users=array();
         $q = $this->arg('q');