stian/gallery3
1
0
Fork 0
mirror of https://github.com/Pathduck/gallery3.git synced 2026-06-02 01:39:21 -04:00
Code Issues Actions Packages Projects Releases Wiki Activity

Properly check comment permissions. Don't show comments that aren't

Browse Source 
published.  Fix _form_add to take an item id.  Oh and email address is
no longer required.
This commit is contained in:
Bharat Mediratta
2009-01-07 08:18:15 +00:00
parent 9460e08da8
commit 17c8e14753
2 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
modules/comment/controllers/comments.php
View File

@@ -84,6 +84,12 @@ class Comments_Controller extends REST_Controller {
* @see REST_Controller::_show($resource)
*/
public function _show($comment) {
$item = ORM::factory("item", $comment->item_id);
access::required("view", $item);
if ($comment->state != "published") {
return;
}
if (rest::output_format() == "json") {
print json_encode(
array("result" => "success",
@@ -100,6 +106,8 @@ class Comments_Controller extends REST_Controller {
* @see REST_Controller::_update($resource)
*/
public function _update($comment) {
$item = ORM::factory("item", $comment->item_id);
access::required("edit", $item);
$form = comment::get_edit_form($comment);
if ($form->validate()) {
@@ -124,6 +132,8 @@ class Comments_Controller extends REST_Controller {
* @see REST_Controller::_delete($resource)
*/
public function _delete($comment) {
$item = ORM::factory("item", $comment->item_id);
access::required("edit", $item);
$comment->delete();
print json_encode(array("result" => "success"));
@@ -133,7 +143,7 @@ class Comments_Controller extends REST_Controller {
* Present a form for adding a new comment to this item or editing an existing comment.
* @see REST_Controller::form_add($resource)
*/
public function _form_add($item) {
public function _form_add($item_id) {
$item = ORM::factory("item", $item_id);
access::required("view", $item);