mirror/php-flarum
1
0
Fork 0
mirror of https://github.com/flarum/core.git synced 2025-05-05 06:57:55 +02:00
Code Issues Releases Wiki Activity

Merge pull request #1358 from clarkwinkelmann/avatar-permission

Browse Source 
Assert permission when updating avatar
This commit is contained in:
Toby Zerner 2018-02-01 06:54:47 +10:30 committed by GitHub
commit 25154dabff
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/User/Command/EditUserHandler.php
View File

@ -147,6 +147,8 @@ class EditUserHandler
} }
if ($avatarUrl = array_get($attributes, 'avatarUrl')) { if ($avatarUrl = array_get($attributes, 'avatarUrl')) {
$this->assertPermission($canEdit);
$validation = $this->validatorFactory->make(compact('avatarUrl'), ['avatarUrl' => 'url']); $validation = $this->validatorFactory->make(compact('avatarUrl'), ['avatarUrl' => 'url']);
if ($validation->fails()) { if ($validation->fails()) {
@ -161,6 +163,8 @@ class EditUserHandler
// //
} }
} elseif (array_key_exists('avatarUrl', $attributes)) { } elseif (array_key_exists('avatarUrl', $attributes)) {
$this->assertPermission($canEdit);
$this->avatarUploader->remove($user); $this->avatarUploader->remove($user);
} }