mozilla/openbadges — pull request #459 by brianloveswords (2012-11-29 22:10:23+00:00)
Title: Check to make sure user owns group in displayer API

Issue #420

In the displayer API, we were neglecting to check if the group actually
belonged to the specified user. While this isn't necessarily a security
hole – groups would still have to be marked as public to be shown – it
was certainly less than ideal.