diff --git a/src/posts/delete.js b/src/posts/delete.js index ada4e2ec6b..19ce9f271b 100644 --- a/src/posts/delete.js +++ b/src/posts/delete.js @@ -17,7 +17,7 @@ module.exports = function (Posts) { plugins.fireHook('filter:post.delete', {pid: pid, uid: uid}, next); }, function (data, next) { - Posts.setPostField(pid, 'deleted', 1, next); + Posts.setPostFields(pid, {deleted: 1, deleterUid: uid}, next); }, function (next) { Posts.getPostFields(pid, ['pid', 'tid', 'uid', 'timestamp'], next); @@ -53,7 +53,7 @@ module.exports = function (Posts) { plugins.fireHook('filter:post.restore', {pid: pid, uid: uid}, next); }, function (data, next) { - Posts.setPostField(pid, 'deleted', 0, next); + Posts.setPostFields(pid, {deleted: 0, deleterUid: 0}, next); }, function (next) { Posts.getPostFields(pid, ['pid', 'tid', 'uid', 'content', 'timestamp'], next); diff --git a/src/privileges/posts.js b/src/privileges/posts.js index 99a193e01d..dbed332b71 100644 --- a/src/privileges/posts.js +++ b/src/privileges/posts.js @@ -158,7 +158,7 @@ module.exports = function (privileges) { var postData; async.waterfall([ function (next) { - posts.getPostFields(pid, ['tid', 'timestamp'], next); + posts.getPostFields(pid, ['uid', 'tid', 'timestamp', 'deleterUid'], next); }, function (_postData, next) { postData = _postData; @@ -190,8 +190,9 @@ module.exports = function (privileges) { if (postDeleteDuration && (Date.now() - parseInt(postData.timestamp, 10) > postDeleteDuration * 1000)) { return callback(null, {flag: false, message: '[[error:post-delete-duration-expired, ' + meta.config.postDeleteDuration + ']]'}); } - - callback(null, {flag: results.isOwner, message: '[[error:no-privileges]]'}); + var deleterUid = parseInt(postData.deleterUid, 10) || 0; + var flag = results.isOwner && (deleterUid === 0 || deleterUid === parseInt(postData.uid, 10)); + callback(null, {flag: flag, message: '[[error:no-privileges]]'}); }); };