github-mirror/framework
2
0
Fork 0
mirror of https://github.com/flarum/framework.git synced 2025-01-23 05:56:15 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1513 from flarum/tz/1419-restrict-own-permissions

Browse Source 
Make "own" permissions depend on the user's ability to reply
This commit is contained in:
Toby Zerner 2018-09-22 12:22:03 +09:30 committed by GitHub
commit ee3287d3e9
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
framework/core/src/Discussion/DiscussionPolicy.php
View File

@ -123,7 +123,7 @@ class DiscussionPolicy extends AbstractPolicy
*/ */
public function rename(User $actor, Discussion $discussion) public function rename(User $actor, Discussion $discussion)
{ {
if ($discussion->user_id == $actor->id) { if ($discussion->user_id == $actor->id && $actor->can('reply', $discussion)) {
$allowRenaming = $this->settings->get('allow_renaming'); $allowRenaming = $this->settings->get('allow_renaming');
if ($allowRenaming === '-1' if ($allowRenaming === '-1'
@ -141,7 +141,7 @@ class DiscussionPolicy extends AbstractPolicy
*/ */
public function hide(User $actor, Discussion $discussion) public function hide(User $actor, Discussion $discussion)
{ {
if ($discussion->user_id == $actor->id && $discussion->participant_count <= 1) { if ($discussion->user_id == $actor->id && $discussion->participant_count <= 1 && $actor->can('reply', $discussion)) {
return true; return true;
} }
} }

2
framework/core/src/Post/PostPolicy.php
View File

@ -107,7 +107,7 @@ class PostPolicy extends AbstractPolicy
// A post is allowed to be edited if the user has permission to moderate // A post is allowed to be edited if the user has permission to moderate
// the discussion which it's in, or if they are the author and the post // the discussion which it's in, or if they are the author and the post
// hasn't been deleted by someone else. // hasn't been deleted by someone else.
if ($post->user_id == $actor->id && (! $post->hidden_at || $post->hidden_user_id == $actor->id)) { if ($post->user_id == $actor->id && (! $post->hidden_at || $post->hidden_user_id == $actor->id) && $actor->can('reply', $post->discussion)) {
$allowEditing = $this->settings->get('allow_post_editing'); $allowEditing = $this->settings->get('allow_post_editing');
if ($allowEditing === '-1' if ($allowEditing === '-1'