fix: check schedule privilege, closes #11032

src/api/helpers.js

@@ -13,7 +13,7 @@ const events = require('../events');
 exports.setDefaultPostData = function (reqOrSocket, data) {
 	data.uid = reqOrSocket.uid;
 	data.req = exports.buildReqObject(reqOrSocket, { ...data });
-	data.timestamp = parseInt(data.timestamp, 10) || Date.now();
+	data.timestamp = Date.now();
 	data.fromQueue = false;
 };
 

src/api/topics.js

@@ -40,13 +40,19 @@ topicsAPI.create = async function (caller, data) {
 	const payload = { ...data };
 	payload.tags = payload.tags || [];
 	apiHelpers.setDefaultPostData(caller, payload);
+	const isScheduling = parseInt(data.timestamp, 10) > payload.timestamp;
+	if (isScheduling) {
+		if (await privileges.categories.can('topics:schedule', data.cid, caller.uid)) {
+			payload.timestamp = parseInt(data.timestamp, 10);
+		} else {
+			throw new Error('[[error:no-privileges]]');
+		}
+	}
 
-	// Blacklist & Post Queue
 	await meta.blacklist.test(caller.ip);
 	const shouldQueue = await posts.shouldQueue(caller.uid, payload);
 	if (shouldQueue) {
-		const queueObj = await posts.addToQueue(payload);
-		return queueObj;
+		return await posts.addToQueue(payload);
 	}
 
 	const result = await topics.post(payload);
@@ -66,12 +72,10 @@ topicsAPI.reply = async function (caller, data) {
 	const payload = { ...data };
 	apiHelpers.setDefaultPostData(caller, payload);
 
-	// Blacklist & Post Queue
 	await meta.blacklist.test(caller.ip);
 	const shouldQueue = await posts.shouldQueue(caller.uid, payload);
 	if (shouldQueue) {
-		const queueObj = await posts.addToQueue(payload);
-		return queueObj;
+		return await posts.addToQueue(payload);
 	}
 
 	const postData = await topics.reply(payload); // postData seems to be a subset of postObj, refactor?