4 files changed, 88 insertions, 4 deletions

diff --git a/mod/groups/actions/discussion/delete.php b/mod/groups/actions/discussion/delete.php
index c3de612d7..f307aa091 100644
--- a/mod/groups/actions/discussion/delete.php
+++ b/mod/groups/actions/discussion/delete.php
@@ -26,4 +26,4 @@ if ($result) {
 	register_error(elgg_echo('discussion:error:notdeleted'));
 }
 
-forward("pg/discussion/owner/$container->guid");
+forward("discussion/owner/$container->guid");
diff --git a/mod/groups/actions/discussion/reply/delete.php b/mod/groups/actions/discussion/reply/delete.php
new file mode 100644
index 000000000..88c6b79d6
--- /dev/null
+++ b/mod/groups/actions/discussion/reply/delete.php
@@ -0,0 +1,26 @@
+<?php
+/**
+ * Delete discussion reply
+ */
+
+$id = (int) get_input('annotation_id');
+
+$reply = elgg_get_annotation_from_id($id);
+if (!$reply || $reply->name != 'group_topic_post') {
+	register_error(elgg_echo('discussion:reply:error:notdeleted'));
+	forward(REFERER);
+}
+
+if (!$reply->canEdit()) {
+	register_error(elgg_echo('discussion:error:permissions'));
+	forward(REFERER);
+}
+
+$result = $reply->delete();
+if ($result) {
+	system_message(elgg_echo('discussion:reply:deleted'));
+} else {
+	register_error(elgg_echo('discussion:reply:error:notdeleted'));
+}
+
+forward(REFERER);
diff --git a/mod/groups/actions/discussion/reply/save.php b/mod/groups/actions/discussion/reply/save.php
new file mode 100644
index 000000000..f8be8aa2c
--- /dev/null
+++ b/mod/groups/actions/discussion/reply/save.php
@@ -0,0 +1,58 @@
+<?php
+/**
+ * Post a reply to discussion topic
+ *
+ */
+
+// Get input
+$entity_guid = (int) get_input('entity_guid');
+$text = get_input('group_topic_post');
+$annotation_id = (int) get_input('annotation_id');
+
+// reply cannot be empty
+if (empty($text)) {
+	register_error(elgg_echo('grouppost:nopost'));
+	forward(REFERER);
+}
+
+$topic = get_entity($entity_guid);
+if (!$topic) {
+	register_error(elgg_echo('grouppost:nopost'));
+	forward(REFERER);
+}
+
+$user = elgg_get_logged_in_user_entity();
+
+$group = $topic->getContainerEntity();
+if (!$group->canWriteToContainer()) {
+	register_error(elgg_echo('groups:notmember'));
+	forward(REFERER);
+}
+
+// if editing a reply, make sure it's valid
+if ($annotation_id) {
+	$annotation = elgg_get_annotation_from_id($annotation_id);
+	if (!$annotation->canEdit()) {
+		register_error(elgg_echo('groups:notowner'));
+		forward(REFERER);
+	}
+
+	$annotation->value = $text;
+	if (!$annotation->save()) {
+		system_message(elgg_echo('groups:forumpost:error'));
+		forward(REFERER);
+	}
+	system_message(elgg_echo('groups:forumpost:edited'));
+} else {
+	// add the reply to the forum topic
+	$reply_id = $topic->annotate('group_topic_post', $text, $topic->access_id, $user->guid);
+	if ($reply_id == false) {
+		system_message(elgg_echo('groupspost:failure'));
+		forward(REFERER);
+	}
+
+	add_to_river('river/annotation/group_topic_post/reply', 'reply', $user->guid, $topic->guid, "", 0, $reply_id);
+	system_message(elgg_echo('groupspost:success'));
+}
+
+forward(REFERER);
diff --git a/mod/groups/actions/discussion/save.php b/mod/groups/actions/discussion/save.php
index 8e8f08a50..b3e9da654 100644
--- a/mod/groups/actions/discussion/save.php
+++ b/mod/groups/actions/discussion/save.php
@@ -4,7 +4,7 @@
  */
 
 // Get variables
-$title = get_input("title");
+$title = htmlspecialchars(get_input('title', '', false), ENT_QUOTES, 'UTF-8');
 $desc = get_input("description");
 $status = get_input("status");
 $access_id = (int) get_input("access_id");
@@ -21,7 +21,7 @@ if (!$title || !$desc) {
 }
 
 $container = get_entity($container_guid);
-if (!$container || (!$container->isMember() && !$container->canEdit())) {
+if (!$container || !$container->canWriteToContainer(0, 'object', 'groupforumtopic')) {
 	register_error(elgg_echo('discussion:error:permissions'));
 	forward(REFERER);
 }
@@ -67,7 +67,7 @@ elgg_clear_sticky_form('topic');
 // handle results differently for new topics and topic edits
 if ($new_topic) {
 	system_message(elgg_echo('discussion:topic:created'));
-	add_to_river('river/forum/topic/create', 'create', get_loggedin_userid(), $topic->guid);
+	add_to_river('river/object/groupforumtopic/create', 'create', elgg_get_logged_in_user_guid(), $topic->guid);
 } else {
 	system_message(elgg_echo('discussion:topic:updated'));
 }