From cb99fc582ef50a4b6dfbbabdcf93998bc1478496 Mon Sep 17 00:00:00 2001
From: mayjs <johannes.may@udo.edu>
Date: Mon, 15 May 2017 21:06:52 +0200
Subject: Modified access to GET /api/boards/:boardId/lists/:listId

---
 models/lists.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/models/lists.js b/models/lists.js
index 8114ff5c..d9a5b8e2 100644
--- a/models/lists.js
+++ b/models/lists.js
@@ -147,9 +147,9 @@ if (Meteor.isServer) {
   });
 
   JsonRoutes.add('GET', '/api/boards/:boardId/lists/:listId', function (req, res, next) {
-    Authentication.checkUserId( req.userId);
     const paramBoardId = req.params.boardId;
     const paramListId = req.params.listId;
+    Authentication.checkBoardAccess( req.userId, paramBoardId);
     JsonRoutes.sendResult(res, {
       code: 200,
       data: Lists.findOne({ _id: paramListId, boardId: paramBoardId, archived: false }),
-- 
cgit v1.2.3-1-g7c22