apply permission check for synching

diff --git a/include/functions_images.inc.php b/include/functions_images.inc.php
index 6861a4ecd958020474ce2fadadc4647df13fee32..a957ffcd910a4184c36f07770666d2c621199cf1 100644 (file)
--- a/include/functions_images.inc.php
+++ b/include/functions_images.inc.php
@@ -885,10 +885,18 @@ function serendipity_syncThumbs() {
         $ft_mime = serendipity_guessMime($f[1]);
         $fdim    = serendipity_getimagesize($ffull, $ft_mime);
 
-        $rs = serendipity_db_query("SELECT * FROM {$serendipity['dbPrefix']}images
-                                            WHERE name = '" . serendipity_db_escape_string($fbase) . "'
-                                              " . ($fdir != '' ? "AND path = '" . serendipity_db_escape_string($fdir) . "'" : '') . "
-                                              AND mime = '" . serendipity_db_escape_string($fdim['mime']) . "'", true, 'assoc');
+        $cond = array(
+            'and' => "WHERE name = '" . serendipity_db_escape_string($fbase) . "'
+                            " . ($fdir != '' ? "AND path = '" . serendipity_db_escape_string($fdir) . "'" : '') . "
+                            AND mime = '" . serendipity_db_escape_string($fdim['mime']) . "'"
+        );
+        serendipity_ACL_SQL($cond, false, 'directory');
+
+        $rs = serendipity_db_query("SELECT * 
+                                      FROM {$serendipity['dbPrefix']}images AS i
+                                           {$cond['joins']}
+                                           
+                                           {$cond['and']}", true, 'assoc');
         if (is_array($rs)) {
             $update    = array();
             $checkfile = $serendipity['serendipityPath'] . $serendipity['uploadPath'] . $rs['path'] . $rs['name'] . '.' . $rs['thumbnail_name'] . '.' . $rs['extension'];