From e53d9f0e8bae9a25424f50c4169dba5d74f0dde5 Mon Sep 17 00:00:00 2001
From: Robin Ward <robin.ward@gmail.com>
Date: Thu, 3 Sep 2015 11:10:04 -0400
Subject: [PATCH] FIX: Don't use observers to update data

Message bus events were triggering users who didn't have access to
update posts to update them. Instead, perform the update in the action
itself.
---
 .../discourse/controllers/topic.js.es6        | 14 ++++--------
 .../javascripts/discourse/models/post.js.es6  | 22 +++++--------------
 2 files changed, 10 insertions(+), 26 deletions(-)

diff --git a/app/assets/javascripts/discourse/controllers/topic.js.es6 b/app/assets/javascripts/discourse/controllers/topic.js.es6
index 2a6d0ffaf9b..80ac937398b 100644
--- a/app/assets/javascripts/discourse/controllers/topic.js.es6
+++ b/app/assets/javascripts/discourse/controllers/topic.js.es6
@@ -428,20 +428,14 @@ export default Ember.Controller.extend(SelectedPostsCount, BufferedContent, {
     },
 
     toggleWiki(post) {
-      // the request to the server is made in an observer in the post class
-      post.toggleProperty('wiki');
+      post.updatePostField('wiki', !post.get('wiki'));
     },
 
     togglePostType(post) {
-      // the request to the server is made in an observer in the post class
-      const regular = this.site.get('post_types.regular'),
-            moderator = this.site.get('post_types.moderator_action');
+      const regular = this.site.get('post_types.regular');
+      const moderator = this.site.get('post_types.moderator_action');
 
-      if (post.get("post_type") === moderator) {
-        post.set("post_type", regular);
-      } else {
-        post.set("post_type", moderator);
-      }
+      post.updatePostField('post_type', post.get('post_type') === moderator ? regular : moderator);
     },
 
     rebakePost(post) {
diff --git a/app/assets/javascripts/discourse/models/post.js.es6 b/app/assets/javascripts/discourse/models/post.js.es6
index 3719dc3d0db..c332836f67f 100644
--- a/app/assets/javascripts/discourse/models/post.js.es6
+++ b/app/assets/javascripts/discourse/models/post.js.es6
@@ -83,23 +83,13 @@ const Post = RestModel.extend({
     return this.get("user_id") === Discourse.User.currentProp("id") || Discourse.User.currentProp('staff');
   }.property("user_id"),
 
-  wikiChanged: function() {
-    const data = { wiki: this.get("wiki") };
-    this._updatePost("wiki", data);
-  }.observes('wiki'),
+  updatePostField(field, value) {
+    const data = {};
+    data[field] = value;
 
-  postTypeChanged: function () {
-    const data = { post_type: this.get("post_type") };
-    this._updatePost("post_type", data);
-  }.observes("post_type"),
-
-  _updatePost(field, data) {
-    const self = this;
-    Discourse.ajax("/posts/" + this.get("id") + "/" + field, {
-      type: "PUT",
-      data: data
-    }).then(function () {
-      self.incrementProperty("version");
+    Discourse.ajax(`/posts/${this.get('id')}/${field}`, { type: 'PUT', data }).then(() => {
+      this.set(field, value);
+      this.incrementProperty("version");
     }).catch(popupAjaxError);
   },