Merge pull request #5192 from BenLubar/replies-permissions

Check whether the user can read the replies

src/socket.io/posts.js

@@ -127,6 +127,9 @@ SocketPosts.getReplies = function (socket, pid, callback) {
 		function (next) {
 			posts.getPidsFromSet('pid:' + pid + ':replies', 0, -1, false, next);
 		},
+		function (pids, next) {
+			privileges.posts.filter('read', pids, socket.uid, next);
+		},
 		function (pids, next) {
 			async.parallel({
 				posts: function (next) {

src/topics/posts.js

@@ -9,6 +9,7 @@ var db = require('../database');
 var user = require('../user');
 var posts = require('../posts');
 var meta = require('../meta');
+var plugins = require('../plugins');
 
 module.exports = function (Topics) {
 
@@ -133,7 +134,12 @@ module.exports = function (Topics) {
 				}
 			});
 
-			callback(null, postData);
+			plugins.fireHook('filter:topics.addPostData', {
+				posts: postData,
+				uid: uid
+			}, function (err, data) {
+				callback(err, data ? data.posts : null);
+			});
 		});
 	};