Sledgehammer tactics on can_edit_extender

git-svn-id: https://code.elgg.org/elgg/trunk@559 36083f99-b078-4883-b0ff-0f9b5a30f544

1 files changed, 5 insertions, 0 deletions

diff --git a/engine/lib/extender.php b/engine/lib/extender.php
index 7cbc647af..5858d6432 100644
--- a/engine/lib/extender.php
+++ b/engine/lib/extender.php
@@ -275,6 +275,9 @@
 	 */

 	function can_edit_extender($extender_id, $type, $user_guid = 0) {

 		

+		if (!isloggedin())

+			return false;

+		

 		if ($user_guid == 0) {

 			if (isset($_SESSION['user'])) {

 				$user = $_SESSION['user'];

@@ -290,6 +293,8 @@
 			$extender = $functionname($extender_id);

 		} else return false;

 		

+		if (!is_a($extender,"ElggExtender")) return false;

+		

 		// If the owner is the specified user, great! They can edit.

 		if ($extender->getOwner() == $user->getGUID()) return true;