fix problem: protected user can't show own page (2) when OAuth Echo

1 files changed, 2 insertions, 3 deletions

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index c109819..dfe866a 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -17,16 +17,15 @@ class ApplicationController < ActionController::Base
 
   def authorized_to_show?(user)
     return true if not user.protected?
-    return true if session[:user_id] == user.id
 
     if session[:user_id]
-      return session[:account].following?(user.id)
+      return session[:user_id] == user.id || session[:account].following?(user.id)
     elsif request.headers["X-Verify-Credentials-Authorization"]
       # OAuth Echo
       user_id = authenticate_with_twitter_oauth_echo
       account = Account.find_by(user_id: user_id)
       if account
-        return account.following?(user.id)
+        return account.user_id == user.id || account.following?(user.id)
       else
         return false
       end