closes #2123

src/controllers/topics.js

@@ -252,6 +252,20 @@ topicsController.get = function(req, res, next) {
 topicsController.teaser = function(req, res, next) {
 	var tid = req.params.topic_id;
 	var uid = req.user ? parseInt(req.user.uid, 10) : 0;
+
+	if (!utils.isNumber(tid)) {
+		return next(new Error('[[error:invalid-tid]]'));
+	}
+
+	privileges.topics.can('read', tid, uid, function(err, canRead) {
+		if (err) {
+			return next(err);
+		}
+
+		if (!canRead) {
+			return res.json(403, '[[error:no-priveges]]');
+		}
+
 		topics.getLatestUndeletedPid(tid, function(err, pid) {
 			if (err) {
 				return next(err);
@@ -273,6 +287,7 @@ topicsController.teaser = function(req, res, next) {
 				res.json(posts[0]);
 			});
 		});
+	});
 };
 
 module.exports = topicsController;