Do not tie debug src loading to needsPermission

knolleary · knolleary · commit ce6594c8cc20 · 2017-01-10T09:43:46.000Z
Fixes node-red#1111
diff --git a/nodes/core/core/58-debug.js b/nodes/core/core/58-debug.js
@@ -189,7 +189,9 @@ module.exports = function(RED) {
         }
     });
 
-    RED.httpAdmin.get("/debug/view/*",RED.auth.needsPermission("debug.read"),function(req,res) {
+    // As debug/view/debug-utils.js is loaded via <script> tag, it won't get
+    // the auth header attached. So do not use RED.auth.needsPermission here.
+    RED.httpAdmin.get("/debug/view/*",function(req,res) {
         var options = {
             root: __dirname + '/lib/debug/',
             dotfiles: 'deny'
