aboutsummaryrefslogtreecommitdiff
path: root/mod/pages/actions
diff options
context:
space:
mode:
authorSem <sembrestels@riseup.net>2012-05-20 02:39:46 +0200
committerSem <sembrestels@riseup.net>2012-05-20 02:39:46 +0200
commit59bec8bc3e61e6ad537c1418e64094d0665470af (patch)
tree9f9826a3ca09a23c46d63284a93bf3523e60f36c /mod/pages/actions
parent5da1b3002e12ed112c92c0902f518c82bdd3fbe0 (diff)
parent14d2c70e1872f4045fc857be9b9022d085f1fbd1 (diff)
downloadelgg-59bec8bc3e61e6ad537c1418e64094d0665470af.tar.gz
elgg-59bec8bc3e61e6ad537c1418e64094d0665470af.tar.bz2
Merge branch '1.8' of git://github.com/Elgg/Elgg into lorea-preprod
Diffstat (limited to 'mod/pages/actions')
-rw-r--r--mod/pages/actions/pages/delete.php5
-rw-r--r--mod/pages/actions/pages/edit.php14
2 files changed, 16 insertions, 3 deletions
diff --git a/mod/pages/actions/pages/delete.php b/mod/pages/actions/pages/delete.php
index dfa0de98d..7a314a280 100644
--- a/mod/pages/actions/pages/delete.php
+++ b/mod/pages/actions/pages/delete.php
@@ -9,8 +9,9 @@
$guid = get_input('guid');
$page = get_entity($guid);
-if ($page) {
- if ($page->canEdit()) {
+if (elgg_instanceof($page, 'object', 'page') || elgg_instanceof($page, 'object', 'page_top')) {
+ // only allow owners and admin to delete
+ if (elgg_is_admin_logged_in() || elgg_get_logged_in_user_guid() == $page->getOwnerGuid()) {
$container = get_entity($page->container_guid);
// Bring all child elements forward
diff --git a/mod/pages/actions/pages/edit.php b/mod/pages/actions/pages/edit.php
index 6950d4b2f..a32e4a4ba 100644
--- a/mod/pages/actions/pages/edit.php
+++ b/mod/pages/actions/pages/edit.php
@@ -47,7 +47,19 @@ if ($page_guid) {
}
if (sizeof($input) > 0) {
+ // don't change access if not an owner/admin
+ $user = elgg_get_logged_in_user_entity();
+ $can_change_access = true;
+
+ if ($user && $page) {
+ $can_change_access = $user->isAdmin() || $user->getGUID() == $page->owner_guid;
+ }
+
foreach ($input as $name => $value) {
+ if (($name == 'access_id' || $name == 'write_access_id') && !$can_change_access) {
+ continue;
+ }
+
$page->$name = $value;
}
}
@@ -74,6 +86,6 @@ if ($page->save()) {
forward($page->getURL());
} else {
- register_error(elgg_echo('pages:error:no_save'));
+ register_error(elgg_echo('pages:error:notsaved'));
forward(REFERER);
}