From b2a78ded677e066362c4a30c0703432ae222f0ce Mon Sep 17 00:00:00 2001
From: plegall <plg@piwigo.org>
Date: Tue, 24 Feb 2026 15:59:08 +0100
Subject: [PATCH] fixes GHSA-397m-gfhm-pmg2 pwg.history.search is only for
 admins

---
 ws.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ws.php b/ws.php
index ac86b4347..25fc8781a 100644
--- a/ws.php
+++ b/ws.php
@@ -1435,7 +1435,8 @@ enabled_high, registration_date, registration_date_string, registration_date_sin
       <br> <strong>Types </strong> can be : \'none\', \'picture\', \'high\', \'other\' 
       <br> <strong>Date format</strong> is yyyy-mm-dd
       <br> <strong>display_thumbnail</strong> can be : \'no_display_thumbnail\', \'display_thumbnail_classic\', \'display_thumbnail_hoverbox\'',
-      $ws_functions_root . 'pwg.php'
+      $ws_functions_root . 'pwg.php',
+      array('admin_only'=>true)
     );
 
     $service->addMethod(