Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-26 08:36:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: include admins, limit to category mods, correct privilege name

Browse Source
This commit is contained in:
gasoved
2021-02-02 14:52:24 +03:00
committed by Julian Lam
parent 4447a64eaa
commit eaf9d2e44a
1 changed files with 9 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/api/posts.js
View File

@@ -261,16 +261,10 @@ postsAPI.getDiffs = async (caller, data) => {
usernames = usernames.map(userObj => (userObj.uid ? userObj.username : null));
const cid = await posts.getCidByPid(data.pid);
const isModerator = await privileges.users.isModerator(cid, caller.uid);
let canEdit = true;
try {
if (!isModerator) {
await user.isPrivilegedOrSelf(caller.uid, post.uid);
}
} catch (e) {
canEdit = false;
}
const [isAdmin, isModerator] = await Promise.all([
user.isAdministrator(caller.uid),
privileges.users.isModerator(caller.uid, cid),
]);
timestamps.push(post.timestamp);
@@ -280,8 +274,10 @@ postsAPI.getDiffs = async (caller, data) => {
timestamp: timestamp,
username: usernames[idx],
})),
editable: canEdit,
deletable: isModerator,
// Only admins, global mods and moderator of that cid can delete a diff
deletable: isAdmin || isModerator,
// These and post owners can restore to a different post version
editable: isAdmin || isModerator || parseInt(caller.uid, 10) === parseInt(post.uid, 10),
};
};
@@ -292,7 +288,7 @@ postsAPI.loadDiff = async (caller, data) => {
postsAPI.restoreDiff = async (caller, data) => {
const cid = await posts.getCidByPid(data.pid);
const canEdit = await privileges.categories.can('edit', cid, caller.uid);
const canEdit = await privileges.categories.can('posts:edit', cid, caller.uid);
if (!canEdit) {
throw new Error('[[error:no-privileges]]');
}