yuuza/outline
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: Viewers cannot delete their own comments

Browse Source
This commit is contained in:
Tom Moor
2023-03-11 19:08:12 -05:00
parent e9ece9125a
commit e2dff9afca
1 changed files with 1 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
server/policies/comment.ts
View File

@@ -2,7 +2,7 @@ import { Comment, User, Team } from "@server/models";
import { allow } from "./cancan"; import { allow } from "./cancan";
allow(User, "createComment", Team, (user, team) => { allow(User, "createComment", Team, (user, team) => {
if (!team || user.isViewer || user.teamId !== team.id) { if (!team || user.teamId !== team.id) {
return false; return false;
} }
return true; return true;
@@ -12,8 +12,5 @@ allow(User, ["read", "update", "delete"], Comment, (user, comment) => {
if (!comment) { if (!comment) {
return false; return false;
} }
if (user.isViewer) {
return false;
}
return user?.id === comment.createdById; return user?.id === comment.createdById;
}); });