Fix possible security issue

diff --git a/src/Module/Calendar/Export.php b/src/Module/Calendar/Export.php
index 30a1bc44deb2cf01b963091f1e733b62857947c3..74fc52b464d5d43de6a1c5b4b725f27c0cc6bc7a 100644 (file)
--- a/src/Module/Calendar/Export.php
+++ b/src/Module/Calendar/Export.php
@@ -58,6 +58,10 @@ class Export extends BaseModule
 
        protected function rawContent(array $request = [])
        {
+               if (!$this->session->getLocalUserId()) {
+                       throw new HTTPException\UnauthorizedException($this->t('Permission denied.'));
+               }
+
                $owner = User::getByNickname($this->parameters['nickname'], ['uid']);
                if (empty($owner)) {
                        throw new HTTPException\NotFoundException($this->t('User not found.'));