Don't expose lat/lon of private traces

diff --git a/app/controllers/site_controller.rb b/app/controllers/site_controller.rb
index 72fe3b241a374e4c514fdd5ce3b76ccd46254245..606143f4f9ceaaa48fe79c40a1d6def05216f0a9 100644 (file)
--- a/app/controllers/site_controller.rb
+++ b/app/controllers/site_controller.rb
@@ -51,7 +51,7 @@ class SiteController < ApplicationController
       @lat = bbox.centre_lat
       @lon = bbox.centre_lon
     elsif params[:gpx]
-      trace = Trace.find(params[:gpx])
+      trace = Trace.visible_to(@user).find(params[:gpx])
       @lat = trace.latitude
       @lon = trace.longitude
     end