Added some more check

diff --git a/include/api.php b/include/api.php
index cea356602e6afc3e7eed0d4eff24e9b09555ee12..32a6c515675fdce42e479a01d826c9ac4c5355be 100644 (file)
--- a/include/api.php
+++ b/include/api.php
@@ -3293,6 +3293,9 @@ api_register_func('api/friendships/destroy', 'api_friendships_destroy', true, AP
  */
 function api_direct_messages_box($type, $box, $verbose)
 {
+       if (empty(BaseApi::getCurrentUserID())) {
+               throw new ForbiddenException();
+       }
        BaseApi::checkAllowedScope(BaseApi::SCOPE_READ);
 
        // params