CRM-13806 - Only accept valid profile urls

http://issues.civicrm.org/jira/browse/CRM-13806

diff --git a/CRM/Core/Invoke.php b/CRM/Core/Invoke.php
index 1dea4ae1e06cfba9174ecfa02518abd9f1af7443..221504f2101f2219bed378200553cc19ca0ae627 100644 (file)
--- a/CRM/Core/Invoke.php
+++ b/CRM/Core/Invoke.php
@@ -456,8 +456,13 @@ class CRM_Core_Invoke {
       }
     }
 
-    $page = new CRM_Profile_Page_Listings();
-    return $page->run();
+    if ($secondArg == 'view' || empty($secondArg)) {
+      $page = new CRM_Profile_Page_Listings();
+      return $page->run();
+    }
+
+    CRM_Utils_System::permissionDenied();
+    return;
   }
 
   /**