Fixed missing permission check

diff --git a/com.woltlab.wcf/templates/userInformationHeadline.tpl b/com.woltlab.wcf/templates/userInformationHeadline.tpl
index 9e116b1796fb53fe9842e67dde758673adb60985..39ea0e24a9df7ece088918415dc90614b08ba493 100644 (file)
--- a/com.woltlab.wcf/templates/userInformationHeadline.tpl
+++ b/com.woltlab.wcf/templates/userInformationHeadline.tpl
@@ -11,7 +11,7 @@
        </h3>
 </div> 
 <ul class="inlineList commaSeparated">
-       {if $user->isAccessible('canViewProfile')}
+       {if $__wcf->getSession()->getPermission('user.profile.canViewUserProfile') && $user->isAccessible('canViewProfile')}
                {if $user->isVisibleOption('gender') && $user->gender}<li>{lang}wcf.user.gender.{if $user->gender == 1}male{else}female{/if}{/lang}</li>{/if}
                {if $user->isVisibleOption('birthday') && $user->getAge()}<li>{@$user->getAge()}</li>{/if}
                {if $user->isVisibleOption('location') && $user->location}<li>{lang}wcf.user.membersList.location{/lang}</li>{/if}

diff --git a/com.woltlab.wcf/templates/userProfilePreview.tpl b/com.woltlab.wcf/templates/userProfilePreview.tpl
index b6467425e4469bbb01013b665dd9a173fc97e70b..c4a4526fb0222c58bdd9917594a6a634db9fb3a7 100644 (file)
--- a/com.woltlab.wcf/templates/userProfilePreview.tpl
+++ b/com.woltlab.wcf/templates/userProfilePreview.tpl
@@ -17,7 +17,7 @@
                        {hascontent}
                                <dl class="plain inlineDataList userFields">
                                        {content}
-                                               {if $user->isAccessible('canViewProfile')}
+                                               {if $__wcf->getSession()->getPermission('user.profile.canViewUserProfile') && $user->isAccessible('canViewProfile')}
                                                        {if $user->occupation}
                                                                <dt>{lang}wcf.user.option.occupation{/lang}</dt>
                                                                <dd>{$user->occupation}</dd>