mirror/outline
1
0
Fork 0
mirror of https://github.com/outline/outline.git synced 2026-01-07 19:49:58 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix: Viewers cannot delete their own comments

Browse Source
This commit is contained in:
Tom Moor
2023-03-11 19:08:12 -05:00
parent e9ece9125a
commit e2dff9afca
1 changed files with 1 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
server/policies/comment.ts
View File

@@ -2,7 +2,7 @@ import { Comment, User, Team } from "@server/models";
import { allow } from "./cancan";
allow(User, "createComment", Team, (user, team) => {
if (!team || user.isViewer || user.teamId !== team.id) {
if (!team || user.teamId !== team.id) {
return false;
}
return true;
@@ -12,8 +12,5 @@ allow(User, ["read", "update", "delete"], Comment, (user, comment) => {
if (!comment) {
return false;
}
if (user.isViewer) {
return false;
}
return user?.id === comment.createdById;
});