summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorYorhel <git@yorhel.nl>2022-01-20 09:12:37 +0100
committerYorhel <git@yorhel.nl>2022-01-20 09:13:32 +0100
commitc119e60e3ddea4c86cabf8e0866b8a0b7f68ad26 (patch)
tree2ced80d16b0a461b951df5a94e8ce7a6b574f62b
parentdbb0df8e7131f82d8c6151fdf2f6052d019df50e (diff)
Validation: Fix authorization of thread edits by creatorHEADmaster
Broken since 8c1fcdb94b46373c4e9c8d533e645edf6aba6f7a (!?)
-rw-r--r--lib/VNWeb/Validation.pm4
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/VNWeb/Validation.pm b/lib/VNWeb/Validation.pm
index bc49d847..ae2b34b1 100644
--- a/lib/VNWeb/Validation.pm
+++ b/lib/VNWeb/Validation.pm
@@ -243,7 +243,9 @@ sub can_edit {
} else {
die "Can't do authorization test when hidden/date/user_id fields aren't present"
if !exists $entry->{hidden} || !exists $entry->{date} || !exists $entry->{user_id};
- return auth && $entry->{user_id} eq auth->uid && !defined $entry->{hidden} && $entry->{date} > time-config->{board_edit_time};
+ # beware: for threads the 'hidden' field is a non-undef boolean flag, for posts it is a possibly-undef text field.
+ my $hidden = $entry->{id} =~ /^t/ && $entry->{num} == 1 ? $entry->{hidden} : defined $entry->{hidden};
+ return auth && $entry->{user_id} eq auth->uid && !$hidden && $entry->{date} > time-config->{board_edit_time};
}
}