Changeset 3745

Timestamp:

10/01/09 11:50:15 (2 years ago)

Author:

rickc

Message:

Ensure the user has permission to delete a post before deleting it.

File:

• trunk/htdocs/system/classes/adminhandler.php (modified) (1 diff)

trunk/htdocs/system/classes/adminhandler.php

@@ -606 +606 @@
                         $okay = FALSE;
                 }
+
+                $post = Post::get( array( 'id' => $id, 'status' => Post::status( 'any' ) ) );
+                if ( ! ACL::access_check( $post->get_access(), 'delete' ) ) {
+                        $okay = FALSE;
+                }
+
                 if ( !$okay )   {
                         Utils::redirect( URL::get( 'admin', 'page=posts&type='. Post::status( 'any' ) ) );
                 }
-                $post = Post::get( array( 'id' => $id, 'status' => Post::status( 'any' ) ) );
+
                 $post->delete();
                 Session::notice( sprintf( _t( 'Deleted the %1$s titled "%2$s".' ), Post::type_name( $post->content_type ), htmlspecialchars( $post->title ) ) );