From ce6594c8cc2008707af3cd87e1da10996c72fded Mon Sep 17 00:00:00 2001
From: Nick O'Leary <nick.oleary@gmail.com>
Date: Tue, 10 Jan 2017 09:43:46 +0000
Subject: [PATCH] Do not tie debug src loading to needsPermission Fixes #1111

---
 nodes/core/core/58-debug.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nodes/core/core/58-debug.js b/nodes/core/core/58-debug.js
index d96bdcacb..85ca09298 100644
--- a/nodes/core/core/58-debug.js
+++ b/nodes/core/core/58-debug.js
@@ -189,7 +189,9 @@ module.exports = function(RED) {
         }
     });
 
-    RED.httpAdmin.get("/debug/view/*",RED.auth.needsPermission("debug.read"),function(req,res) {
+    // As debug/view/debug-utils.js is loaded via <script> tag, it won't get
+    // the auth header attached. So do not use RED.auth.needsPermission here.
+    RED.httpAdmin.get("/debug/view/*",function(req,res) {
         var options = {
             root: __dirname + '/lib/debug/',
             dotfiles: 'deny'