    public function edit()
    {
        global $user;

        $id = !empty($this->params['id']) ? $this->params['id'] : null;

        // check to see if we should be editing.  You either need to be an admin, or editing own account.
        if ($user->isAdmin() || ($user->id == $id)) {
            $record = new address($id);
        } else {
            flash('error', gt('You do not have the proper permissions to edit this address'));
            expHistory::back();
        }

        $config = ecomconfig::getConfig('address_allow_admins_all');
        assign_to_template(array(
            'record'=>$record,
            'admin_config'=>$config
        ));
        if (expSession::get('customer-signup')) {
            assign_to_template(array(
                'checkout'=>true
            ));
        }
    }
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.