	public function myaddressbook() {
		global $user;

		// check if the user is logged in.
		expQueue::flashIfNotLoggedIn('message',gt('You must be logged in to manage your address book.'));
        if (!$user->isAdmin() && $this->params['user_id'] != $user->id) {
            unset($this->params['user_id']);
        }
		expHistory::set('viewable', $this->params);
		$userid = (empty($this->params['user_id'])) ? $user->id : $this->params['user_id'];
		assign_to_template(array(
            'addresses'=>$this->address->find('all', 'user_id='.$userid)
        ));
	}
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.