summaryrefslogtreecommitdiff
path: root/modules/comment/controllers/comments.php
diff options
context:
space:
mode:
authorandyst <andy.st@gmail.com>2009-06-01 23:45:37 -0700
committerandyst <andy.st@gmail.com>2009-06-01 23:45:37 -0700
commit02a840c84cada5a1c0cc0768f350424460310e5d (patch)
tree6a35d4afddcf291327a4ff42245bca17328084ae /modules/comment/controllers/comments.php
parentd0845aadc629cf10b8eee490a651c039750a1430 (diff)
parent3b6567f38c206f1302c7b22d94d5eae4b458311a (diff)
Merge branch 'master' of git@github.com:gallery/gallery3
Diffstat (limited to 'modules/comment/controllers/comments.php')
-rw-r--r--modules/comment/controllers/comments.php5
1 files changed, 5 insertions, 0 deletions
diff --git a/modules/comment/controllers/comments.php b/modules/comment/controllers/comments.php
index 930579ac..c48bd380 100644
--- a/modules/comment/controllers/comments.php
+++ b/modules/comment/controllers/comments.php
@@ -134,6 +134,7 @@ class Comments_Controller extends REST_Controller {
*/
public function _update($comment) {
$item = ORM::factory("item", $comment->item_id);
+ access::required("view", $item);
access::required("edit", $item);
$form = comment::get_edit_form($comment);
@@ -161,6 +162,7 @@ class Comments_Controller extends REST_Controller {
*/
public function _delete($comment) {
$item = ORM::factory("item", $comment->item_id);
+ access::required("view", $item);
access::required("edit", $item);
$comment->delete();
@@ -183,6 +185,9 @@ class Comments_Controller extends REST_Controller {
* @see REST_Controller::form_edit($resource)
*/
public function _form_edit($comment) {
+ if (!user::active()->admin) {
+ access::forbidden();
+ }
print comment::get_edit_form($comment);
}
}