Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-26 16:46:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: include admins, limit to category mods, correct privilege name

Browse Source
This commit is contained in:
gasoved
2021-02-02 14:52:24 +03:00
committed by Julian Lam
parent 4447a64eaa
commit eaf9d2e44a
1 changed files with 9 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/api/posts.js
View File

@@ -261,16 +261,10 @@ postsAPI.getDiffs = async (caller, data) => {
usernames = usernames.map(userObj => (userObj.uid ? userObj.username : null)); usernames = usernames.map(userObj => (userObj.uid ? userObj.username : null));
const cid = await posts.getCidByPid(data.pid); const cid = await posts.getCidByPid(data.pid);
const isModerator = await privileges.users.isModerator(cid, caller.uid); const [isAdmin, isModerator] = await Promise.all([
user.isAdministrator(caller.uid),
let canEdit = true; privileges.users.isModerator(caller.uid, cid),
try { ]);
if (!isModerator) {
await user.isPrivilegedOrSelf(caller.uid, post.uid);
}
} catch (e) {
canEdit = false;
}
timestamps.push(post.timestamp); timestamps.push(post.timestamp);
@@ -280,8 +274,10 @@ postsAPI.getDiffs = async (caller, data) => {
timestamp: timestamp, timestamp: timestamp,
username: usernames[idx], username: usernames[idx],
})), })),
editable: canEdit, // Only admins, global mods and moderator of that cid can delete a diff
deletable: isModerator, deletable: isAdmin || isModerator,
// These and post owners can restore to a different post version
editable: isAdmin || isModerator || parseInt(caller.uid, 10) === parseInt(post.uid, 10),
}; };
}; };
@@ -292,7 +288,7 @@ postsAPI.loadDiff = async (caller, data) => {
postsAPI.restoreDiff = async (caller, data) => { postsAPI.restoreDiff = async (caller, data) => {
const cid = await posts.getCidByPid(data.pid); const cid = await posts.getCidByPid(data.pid);
const canEdit = await privileges.categories.can('edit', cid, caller.uid); const canEdit = await privileges.categories.can('posts:edit', cid, caller.uid);
if (!canEdit) { if (!canEdit) {
throw new Error('[[error:no-privileges]]'); throw new Error('[[error:no-privileges]]');
} }