diff --git a/src/controllers/accounts/helpers.js b/src/controllers/accounts/helpers.js index 1046529442..1e120cc0d0 100644 --- a/src/controllers/accounts/helpers.js +++ b/src/controllers/accounts/helpers.js @@ -36,6 +36,9 @@ helpers.getUserDataByUserSlug = function (userslug, callerUID, callback) { isGlobalModerator: function (next) { user.isGlobalModerator(callerUID, next); }, + isModerator: function (next) { + user.isModeratorOfAnyCategory(callerUID, next); + }, isFollowing: function (next) { user.isFollowing(callerUID, uid, next); }, @@ -65,6 +68,7 @@ helpers.getUserDataByUserSlug = function (userslug, callerUID, callback) { var userSettings = results.userSettings; var isAdmin = results.isAdmin; var isGlobalModerator = results.isGlobalModerator; + var isModerator = results.isModerator; var isSelf = parseInt(callerUID, 10) === parseInt(userData.uid, 10); userData.joindateISO = utils.toISOString(userData.joindate); @@ -87,7 +91,7 @@ helpers.getUserDataByUserSlug = function (userslug, callerUID, callback) { userData.ips = results.ips; } - if (!isAdmin && !isGlobalModerator) { + if (!isAdmin && !isGlobalModerator && !isModerator) { userData.moderationNote = undefined; } @@ -96,7 +100,9 @@ helpers.getUserDataByUserSlug = function (userslug, callerUID, callback) { userData.theirid = userData.uid; userData.isAdmin = isAdmin; userData.isGlobalModerator = isGlobalModerator; + userData.isModerator = isModerator; userData.isAdminOrGlobalModerator = isAdmin || isGlobalModerator; + userData.isAdminOrGlobalModeratorOrModerator = isAdmin || isGlobalModerator || isModerator; userData.canBan = isAdmin || isGlobalModerator; userData.canChangePassword = isAdmin || (isSelf && parseInt(meta.config['password:disableEdit'], 10) !== 1); userData.isSelf = isSelf; diff --git a/src/middleware/user.js b/src/middleware/user.js index a9dc90eb94..02e440914e 100644 --- a/src/middleware/user.js +++ b/src/middleware/user.js @@ -34,6 +34,18 @@ module.exports = function (middleware) { } user.isAdminOrGlobalMod(req.uid, next); + }, + function(allowed, next) { + if (allowed) { + return next(null, allowed); + } + + // For the account/info page only, allow plain moderators through + if (/user\/.+\/info$/.test(req.path)) { + user.isModeratorOfAnyCategory(req.uid, next); + } else { + next(null, false); + } } ], function (err, allowed) { if (err || allowed) { diff --git a/src/socket.io/user.js b/src/socket.io/user.js index 166db2dffd..4d5f752b5d 100644 --- a/src/socket.io/user.js +++ b/src/socket.io/user.js @@ -328,8 +328,15 @@ SocketUser.setModerationNote = function (socket, data, callback) { function (next) { user.isAdminOrGlobalMod(socket.uid, next); }, - function (isAdminOrGlobalMod, next) { - if (!isAdminOrGlobalMod) { + function (allowed, next) { + if (allowed) { + return next(null, allowed); + } + + user.isModeratorOfAnyCategory(socket.uid, next); + }, + function (allowed, next) { + if (!allowed) { return next(new Error('[[error:no-privileges]]')); } if (data.note) {