Fix fatal when multiple sites are requested in referrers API report (#13439)

* Fix fatal when multiple sites are requested in referrers API report

* add more checks

1 files changed, 5 insertions, 3 deletions

diff --git a/plugins/Annotations/API.php b/plugins/Annotations/API.php
index 5c74534db6..136b4ececd 100644
--- a/plugins/Annotations/API.php
+++ b/plugins/Annotations/API.php
@@ -41,9 +41,9 @@ class API extends \Piwik\Plugin\API
      */
     public function add($idSite, $date, $note, $starred = 0)
     {
+        $this->checkUserCanAddNotesFor($idSite);
         $this->checkSingleIdSite($idSite, $extraMessage = "Note: Cannot add one note to multiple sites.");
         $this->checkDateIsValid($date);
-        $this->checkUserCanAddNotesFor($idSite);
 
         // add, save & return a new annotation
         $annotations = new AnnotationList($idSite);
@@ -127,9 +127,10 @@ class API extends \Piwik\Plugin\API
      */
     public function deleteAll($idSite)
     {
-        $this->checkSingleIdSite($idSite, $extraMessage = "Note: Cannot delete annotations from multiple sites.");
         Piwik::checkUserHasSuperUserAccess();
 
+        $this->checkSingleIdSite($idSite, $extraMessage = "Note: Cannot delete annotations from multiple sites.");
+
         $annotations = new AnnotationList($idSite);
 
         // remove the notes & save the list
@@ -152,9 +153,10 @@ class API extends \Piwik\Plugin\API
      */
     public function get($idSite, $idNote)
     {
-        $this->checkSingleIdSite($idSite, $extraMessage = "Note: Specify only one site ID when getting ONE note.");
         Piwik::checkUserHasViewAccess($idSite);
 
+        $this->checkSingleIdSite($idSite, $extraMessage = "Note: Specify only one site ID when getting ONE note.");
+
         // get single annotation
         $annotations = new AnnotationList($idSite);
         return $annotations->get($idSite, $idNote);