yuuza/outline
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Allow workspace admins to remove comments (#5270)

Browse Source
This commit is contained in:
Tom Moor
2023-04-27 21:34:01 -04:00
committed by GitHub
parent ef075c0fa2
commit 4dade03c33
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
server/policies/comment.ts
View File

@@ -12,5 +12,9 @@ allow(User, ["read", "update", "delete"], Comment, (user, comment) => {
if (!comment) {
return false;
}
return user?.id === comment.createdById;
if (user.teamId !== comment.createdBy.teamId) {
return false;
}
return user.isAdmin || user?.id === comment.createdById;
});

4
server/routes/api/comments/comments.ts
View File

@@ -1,5 +1,4 @@
import Router from "koa-router";
import { Transaction } from "sequelize";
import commentCreator from "@server/commands/commentCreator";
import commentDestroyer from "@server/commands/commentDestroyer";
import commentUpdater from "@server/commands/commentUpdater";
@@ -122,9 +121,8 @@ router.post(
const { user } = ctx.state.auth;
const { transaction } = ctx.state;
const comment = await Comment.unscoped().findByPk(id, {
const comment = await Comment.findByPk(id, {
transaction,
lock: Transaction.LOCK.UPDATE,
});
authorize(user, "delete", comment);