mirror/php-e107
1
0
Fork 0
mirror of https://github.com/e107inc/e107.git synced 2025-07-31 20:00:37 +02:00
Code Issues Releases Wiki Activity

FIX check if user has moderator permissions for the thread/forum

Browse Source 
Without admin permissions (member of user class 254) it was not possible
to delete a post in the forum. This fix add the threadId to the ajax query
and fetchs the forum-moderator for the thread which will then checked
against the user permissions/classes.

I added also an additional error message, if something goes wrong.
This commit is contained in:
phibel
2018-09-30 17:21:05 +02:00
parent 1d6a957793
commit 98213ec03c
3 changed files with 36 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
e107_plugins/forum/forum_class.php
View File

@@ -370,29 +370,39 @@ class e107forum
public function ajaxModerate()
{
if(!$this->isModerator(USERID)) //FIXME check permissions per forum.
$ret = array('hide' => false, 'msg' => 'unkown', 'status' => 'error');
$modArray = array();
// get moderator-class for the thread to check permissions of the user
if (isset($_POST['thread']))
{
exit;
$threadId = intval($_POST['thread']);
$sql = e107::getDb();
$query = "SELECT f.forum_moderators
FROM #forum AS f
INNER JOIN #forum_thread AS ft ON f.forum_id = ft.thread_forum_id
WHERE ft.thread_id = ". $threadId;
$sql->gen($query);
$row = $sql->fetch();
$modArray = $this->forumGetMods($row[forum_moderators]);
}
if(!vartrue($_POST['thread']) && !vartrue($_POST['post']))
{
exit;
}
$id = intval($_POST['thread']);
// print_r($_POST);
$ret = array('hide' => false, 'msg' => '', 'status' => null);
// Check if user has moderator permissions for this thread
if(!in_array(USERID, array_keys($modArray)))
{
$ret['msg'] = ''.LAN_FORUM_8030.' '. json_encode($_POST);
$ret['hide'] = false;
$ret['status'] = 'error';
}
else
{
switch ($_POST['action'])
{
case 'delete':
if($this->threadDelete($id))
if($this->threadDelete($threadId))
{
$ret['msg'] = ''.LAN_FORUM_8020.' #'.$id;
$ret['msg'] = ''.LAN_FORUM_8020.' #'.$threadId;
$ret['hide'] = true;
$ret['status'] = 'ok';
}
@@ -426,7 +436,7 @@ class e107forum
break;
case 'lock':
if(e107::getDb()->update('forum_thread', 'thread_active=0 WHERE thread_id='.$id))
if(e107::getDb()->update('forum_thread', 'thread_active=0 WHERE thread_id='.$threadId))
{
$ret['msg'] = LAN_FORUM_CLOSE;
$ret['status'] = 'ok';
@@ -439,7 +449,7 @@ class e107forum
break;
case 'unlock':
if(e107::getDb()->update('forum_thread', 'thread_active=1 WHERE thread_id='.$id))
if(e107::getDb()->update('forum_thread', 'thread_active=1 WHERE thread_id='.$threadId))
{
$ret['msg'] = LAN_FORUM_OPEN;
$ret['status'] = 'ok';
@@ -452,7 +462,7 @@ class e107forum
break;
case 'stick':
if(e107::getDb()->update('forum_thread', 'thread_sticky=1 WHERE thread_id='.$id))
if(e107::getDb()->update('forum_thread', 'thread_sticky=1 WHERE thread_id='.$threadId))
{
$ret['msg'] = LAN_FORUM_STICK;
$ret['status'] = 'ok';
@@ -465,7 +475,7 @@ class e107forum
break;
case 'unstick':
if(e107::getDb()->update('forum_thread', 'thread_sticky=0 WHERE thread_id='.$id))
if(e107::getDb()->update('forum_thread', 'thread_sticky=0 WHERE thread_id='.$threadId))
{
$ret['msg'] = LAN_FORUM_UNSTICK;
$ret['status'] = 'ok';
@@ -486,10 +496,10 @@ class e107forum
$ret['msg'] = LAN_FORUM_8027;
break;
}
echo json_encode($ret);
}
echo json_encode($ret);
exit;
exit();
}