Backport ACL REST permission fix

airtime_mvc/application/configs/ACL.php

@@ -48,7 +48,8 @@ $ccAcl->allow('G', 'index')
       ->allow('G', 'locale')
       ->allow('G', 'upgrade')
       ->allow('G', 'downgrade')
-      ->allow('G', 'rest:media')
+      ->allow('G', 'rest:media', 'get')
+      ->allow('H', 'rest:media')
       ->allow('H', 'preference', 'is-import-in-progress')
       ->allow('H', 'usersettings')
       ->allow('H', 'plupload')

airtime_mvc/application/controllers/plugins/Acl_plugin.php

@@ -123,7 +123,9 @@ class Zend_Controller_Plugin_Acl extends Zend_Controller_Plugin_Abstract
                     die();
                 }
             }
-
+            else  //Non-REST, regular Airtime web app requests
+            {
+                //Redirect you to the login screen since you have no session.
                 if ($controller !== 'login') {
 
                     if ($request->isXmlHttpRequest()) {
@@ -144,7 +146,9 @@ class Zend_Controller_Plugin_Acl extends Zend_Controller_Plugin_Abstract
                         $r->gotoSimpleAndExit('index', 'login', $request->getModuleName());
                    }
                 }
-        } else {
+            }
+        } else { //We have a session/identity.
+
             // If we have an identity and we're making a RESTful request,
             // we need to check the CSRF token
             if ($request->_action != "get" && $request->getModuleName() == "rest") {