FIX: People could retitle restricted topics

Sort of a security fix but not really
This commit is contained in:
riking 2015-02-25 21:08:52 -08:00
parent 8772643e63
commit 1c0658e204

View File

@ -28,6 +28,7 @@ module TopicGuardian
# Editing Method
def can_edit_topic?(topic)
return false if Discourse.static_doc_topic_ids.include?(topic.id) && !is_admin?
return false unless can_see?(topic)
return true if is_staff? || (!topic.private_message? && user.has_trust_level?(TrustLevel[3]))
return false if topic.archived
is_my_own?(topic) && !topic.edit_time_limit_expired?