From 49b08f9be2c253aa256b8fc4adfe7d268ba51093 Mon Sep 17 00:00:00 2001
From: mpl <mathieu.lonjaret@gmail.com>
Date: Sun, 30 Jun 2013 22:45:16 +0200
Subject: [PATCH] publish: disable js functionalities if not owner

Change-Id: I5a20b208704abc9ef214c7ecb2e9fe7a814ac121
---
 pkg/server/publish.go | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkg/server/publish.go b/pkg/server/publish.go
index 8dfe01d1e..7c75e2cd5 100644
--- a/pkg/server/publish.go
+++ b/pkg/server/publish.go
@@ -517,12 +517,10 @@ func (pr *publishRequest) serveSubject() {
 			camliPage = camliClosurePage(pr.ph.JSFiles[0])
 		}
 
-		if camliPage != "" {
+		if camliPage != "" && pr.ViewerIsOwner() {
 			pr.pf(" <script src='%s'></script>\n", pr.staticPath("closure/goog/base.js"))
 			pr.pf(" <script src='%s'></script>\n", pr.staticPath("deps.js"))
-			if pr.ViewerIsOwner() {
 				pr.pf(" <script src='%s'></script>\n", pr.base+"?camli.mode=config&var=CAMLISTORE_CONFIG")
-			}
 			pr.pf(" <script src='%s'></script>\n", pr.staticPath("base64.js"))
 			pr.pf(" <script src='%s'></script>\n", pr.staticPath("Crypto.js"))
 			pr.pf(" <script src='%s'></script>\n", pr.staticPath("SHA1.js"))
@@ -594,7 +592,7 @@ func (pr *publishRequest) serveSubject() {
 		pr.pf("</ul>\n")
 	}
 
-	if camliPage != "" {
+	if camliPage != "" && pr.ViewerIsOwner() {
 		pr.pf("<script>\n")
 		pr.pf("var page = new camlistore.%s(CAMLISTORE_CONFIG);\n", camliPage)
 		pr.pf("page.decorate(document.body);\n")