From 34403d3bd3dc6c372187e9c75ac90f288cb88177 Mon Sep 17 00:00:00 2001 From: friendica Date: Fri, 28 Mar 2014 01:12:52 -0700 Subject: fix delete missing permission check --- mod/item.php | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'mod') diff --git a/mod/item.php b/mod/item.php index 39a44647c..3d1ede507 100644 --- a/mod/item.php +++ b/mod/item.php @@ -898,9 +898,14 @@ function item_content(&$a) { ); if($i) { - + $can_delete = false; + if(local_user() && local_user() == $i[0]['uid']) + $can_delete = true; $ob_hash = get_observer_hash(); - if($ob_hash !== $i[0]['author_xchan'] && $ob_hash !== $i[0]['owner_xchan'] && $ob_hash !== $i[0]['source_xchan']) { + if($ob_hash && ($ob_hash === $i[0]['author_xchan'] || $ob_hash === $i[0]['owner_xchan'] || $ob_hash === $i[0]['source_xchan'])) + $can_delete = true; + + if(! $can_delete) { notice( t('Permission denied.') . EOL); return; } -- cgit v1.2.3