diff options
| author | Steve Clay <steve@mrclay.org> | 2012-06-24 00:09:17 -0400 |
|---|---|---|
| committer | Steve Clay <steve@mrclay.org> | 2012-06-24 00:09:17 -0400 |
| commit | 4a3c49240140449ef4c91c4b999a91b11380db3c (patch) | |
| tree | 3d1e92342473e2fd90059d9abcfe88e79def9a25 /mod/notifications/actions/save.php | |
| parent | d71309056037adc869319566f9ec53313eb192d8 (diff) | |
| download | elgg-4a3c49240140449ef4c91c4b999a91b11380db3c.tar.gz elgg-4a3c49240140449ef4c91c4b999a91b11380db3c.tar.bz2 | |
Fixes #4138: Admin can edit any users' notifications
Diffstat (limited to 'mod/notifications/actions/save.php')
| -rw-r--r-- | mod/notifications/actions/save.php | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/mod/notifications/actions/save.php b/mod/notifications/actions/save.php index 163b656aa..3fe0001a3 100644 --- a/mod/notifications/actions/save.php +++ b/mod/notifications/actions/save.php @@ -6,9 +6,18 @@ * @package ElggNotifications */ -$user = elgg_get_logged_in_user_entity(); +$current_user = elgg_get_logged_in_user_entity(); + +$guid = (int) get_input('guid', 0); +if (!$guid || !($user = get_entity($guid))) { + forward(); +} +if (($user->guid != $current_user->guid) && !$current_user->isAdmin()) { + forward(); +} global $NOTIFICATION_HANDLERS; +$subscriptions = array(); foreach($NOTIFICATION_HANDLERS as $method => $foo) { $subscriptions[$method] = get_input($method.'subscriptions'); $personal[$method] = get_input($method.'personal'); |