diff --git a/public/src/client/topic/threadTools.js b/public/src/client/topic/threadTools.js index 95d1e61adb..82ee651ef9 100644 --- a/public/src/client/topic/threadTools.js +++ b/public/src/client/topic/threadTools.js @@ -94,9 +94,15 @@ define('forum/topic/threadTools', ['forum/topic/fork', 'forum/topic/move', 'comp function topicCommand(command, tid) { translator.translate('[[topic:thread_tools.' + command + '_confirm]]', function(msg) { bootbox.confirm(msg, function(confirm) { - if (confirm) { - socket.emit('topics.' + command, {tids: [tid], cid: ajaxify.data.cid}); + if (!confirm) { + return; } + + socket.emit('topics.' + command, {tids: [tid], cid: ajaxify.data.cid}, function(err) { + if (err) { + app.alertError(err.message); + } + }); }); }); } diff --git a/src/postTools.js b/src/postTools.js index d84d2a0da4..f4e982637f 100644 --- a/src/postTools.js +++ b/src/postTools.js @@ -56,13 +56,18 @@ var async = require('async'), } PostTools.purge = function(uid, pid, callback) { - privileges.posts.canEdit(pid, uid, function(err, canEdit) { - if (err || !canEdit) { - return callback(err || new Error('[[error:no-privileges]]')); + async.waterfall([ + function (next) { + privileges.posts.canPurge(pid, uid, next); + }, + function (canPurge, next) { + if (!canPurge) { + return callback(new Error('[[error:no-privileges]]')); + } + cache.del(pid); + posts.purge(pid, next); } - cache.del(pid); - posts.purge(pid, callback); - }); + ], callback); }; diff --git a/src/privileges/categories.js b/src/privileges/categories.js index 8e2e9213d1..3e454ccf9f 100644 --- a/src/privileges/categories.js +++ b/src/privileges/categories.js @@ -22,14 +22,15 @@ module.exports = function(privileges) { {name: 'Access & Read'}, {name: 'Create Topics'}, {name: 'Reply to Topics'}, + {name: 'Purge'}, {name: 'Moderate'} ]; var userPrivilegeList = [ - 'find', 'read', 'topics:create', 'topics:reply', 'mods' + 'find', 'read', 'topics:create', 'topics:reply', 'purge', 'mods' ]; var groupPrivilegeList = [ - 'groups:find', 'groups:read', 'groups:topics:create', 'groups:topics:reply', 'groups:moderate' + 'groups:find', 'groups:read', 'groups:topics:create', 'groups:topics:reply', 'groups:purge', 'groups:moderate' ]; async.parallel({ @@ -194,6 +195,15 @@ module.exports = function(privileges) { ], callback); }; + privileges.categories.isUserAllowedTo = function(privilege, cid, uid, callback) { + if (!cid) { + return callback(null, false); + } + helpers.isUserAllowedTo(privilege, uid, [cid], function(err, results) { + callback(err, Array.isArray(results) && results.length ? results[0] : false); + }); + }; + privileges.categories.can = function(privilege, cid, uid, callback) { if (!cid) { return callback(null, false); diff --git a/src/privileges/posts.js b/src/privileges/posts.js index f39de4e08e..be78b56699 100644 --- a/src/privileges/posts.js +++ b/src/privileges/posts.js @@ -127,6 +127,24 @@ module.exports = function(privileges) { }); }; + privileges.posts.canPurge = function(pid, uid, callback) { + async.waterfall([ + function (next) { + posts.getCidByPid(pid, next); + }, + function (cid, next) { + async.parallel({ + purge: async.apply(privileges.categories.isUserAllowedTo, 'purge', cid, uid), + owner: async.apply(posts.isOwner, pid, uid), + isAdminOrMod: async.apply(privileges.categories.isAdminOrMod, cid, uid) + }, next); + }, + function (results, next) { + next(null, results.isAdminOrMod || (results.purge && results.owner)); + } + ], callback); + }; + function isPostEditable(pid, uid, callback) { async.waterfall([ function(next) { diff --git a/src/privileges/topics.js b/src/privileges/topics.js index da5a61271b..33a65216e9 100644 --- a/src/privileges/topics.js +++ b/src/privileges/topics.js @@ -170,6 +170,24 @@ module.exports = function(privileges) { ], callback); }; + privileges.topics.canPurge = function(tid, uid, callback) { + async.waterfall([ + function (next) { + topics.getTopicField(tid, 'cid', next); + }, + function (cid, next) { + async.parallel({ + purge: async.apply(privileges.categories.isUserAllowedTo, 'purge', cid, uid), + owner: async.apply(topics.isOwner, tid, uid), + isAdminOrMod: async.apply(privileges.categories.isAdminOrMod, cid, uid) + }, next); + }, + function (results, next) { + next(null, results.isAdminOrMod || (results.purge && results.owner)); + } + ], callback); + }; + privileges.topics.canEdit = function(tid, uid, callback) { winston.warn('[deprecated] please use privileges.topics.isOwnerOrAdminOrMod'); privileges.topics.isOwnerOrAdminOrMod(tid, uid, callback); diff --git a/src/threadTools.js b/src/threadTools.js index bbf78e1054..9ae4e3d921 100644 --- a/src/threadTools.js +++ b/src/threadTools.js @@ -75,10 +75,10 @@ var async = require('async'), if (!exists) { return callback(); } - privileges.topics.isOwnerOrAdminOrMod(tid, uid, next); + privileges.topics.canPurge(tid, uid, next); }, - function (isOwnerOrAdminOrMod, next) { - if (!isOwnerOrAdminOrMod) { + function (canPurge, next) { + if (!canPurge) { return next(new Error('[[error:no-privileges]]')); }