Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-31 19:15:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: dont allow edit if post is deleted by someone else

Browse Source
This commit is contained in:
Baris Usakli
2019-06-26 12:06:57 -04:00
parent 77347d0a99
commit 667bc67f04
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/privileges/posts.js
View File

@@ -154,7 +154,7 @@ module.exports = function (privileges) {
isMod: async.apply(posts.isModerator, [pid], uid), isMod: async.apply(posts.isModerator, [pid], uid),
owner: async.apply(posts.isOwner, pid, uid), owner: async.apply(posts.isOwner, pid, uid),
edit: async.apply(privileges.posts.can, 'posts:edit', pid, uid), edit: async.apply(privileges.posts.can, 'posts:edit', pid, uid),
postData: async.apply(posts.getPostFields, pid, ['tid', 'timestamp']), postData: async.apply(posts.getPostFields, pid, ['tid', 'timestamp', 'deleted', 'deleterUid']),
}, next); }, next);
}, },
function (_results, next) { function (_results, next) {
@@ -174,6 +174,10 @@ module.exports = function (privileges) {
return callback(null, { flag: false, message: '[[error:topic-locked]]' }); return callback(null, { flag: false, message: '[[error:topic-locked]]' });
} }
if (!results.isMod && results.postData.deleted && parseInt(uid, 10) !== parseInt(results.postData.deleterUid, 10)) {
return callback(null, { flag: false, message: '[[error:post-deleted]]' });
}
results.pid = parseInt(pid, 10); results.pid = parseInt(pid, 10);
results.uid = uid; results.uid = uid;