better logic around protecting messages

darcs-hash:20080923182024-5ed1f-cd751ae81cde929ab377734a41e0cdad321ffec5.gz

1 files changed, 3 insertions, 6 deletions

diff --git a/actions/showmessage.php b/actions/showmessage.php
index ce4a1f372..28e359450 100644
--- a/actions/showmessage.php
+++ b/actions/showmessage.php
@@ -38,15 +38,12 @@ class ShowmessageAction extends MailboxAction {
 		
 		$cur = common_current_user();
 		
-		if (!$cur ||
-			$cur->id != $message->from_profile &&
-			$cur->id != $message->to_profile) 
-		{
+		if ($cur && ($cur->id == $message->from_profile || $cur->id == $message->to_profile)) {
+			$this->show_page($cur, 1);
+		} else {
 			$this->client_error(_('Only the sender and recipient may read this message.'), 403);
 			return;
 		}
-			
-		$this->show_page($cur, 1);
 	}
 	
 	function get_message() {