For good measure, don't return autocomplete results when not logged in.

1 files changed, 8 insertions, 0 deletions

diff --git a/plugins/Autocomplete/autocomplete.php b/plugins/Autocomplete/autocomplete.php
index c4b30d264..c92002245 100644
--- a/plugins/Autocomplete/autocomplete.php
+++ b/plugins/Autocomplete/autocomplete.php
@@ -87,7 +87,15 @@ class AutocompleteAction extends Action
 
     function prepare($args)
     {
+        // If we die, show short error messages.
+        StatusNet::setApi(true);
+
         parent::prepare($args);
+
+        $cur = common_current_user();
+        if (!$cur) {
+            throw new ClientException('Access forbidden', true);
+        }
         $this->groups=array();
         $this->users=array();
         $q = $this->arg('q');