|
|
|
@ -32,39 +32,35 @@ module.exports = function (privileges) {
|
|
|
|
|
'posts:edit': async.apply(helpers.isUserAllowedTo, 'posts:edit', uid, cids),
|
|
|
|
|
}, next);
|
|
|
|
|
},
|
|
|
|
|
], function (err, results) {
|
|
|
|
|
if (err) {
|
|
|
|
|
return callback(err);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
var privileges = [];
|
|
|
|
|
|
|
|
|
|
for (var i = 0; i < pids.length; i += 1) {
|
|
|
|
|
function (results, next) {
|
|
|
|
|
var privileges = pids.map(function (pid, i) {
|
|
|
|
|
var isAdminOrMod = results.isAdmin || results.isModerator[i];
|
|
|
|
|
var editable = isAdminOrMod || (results.isOwner[i] && results['posts:edit'][i]);
|
|
|
|
|
|
|
|
|
|
privileges.push({
|
|
|
|
|
return {
|
|
|
|
|
editable: editable,
|
|
|
|
|
view_deleted: editable,
|
|
|
|
|
move: isAdminOrMod,
|
|
|
|
|
isAdminOrMod: isAdminOrMod,
|
|
|
|
|
'topics:read': results['topics:read'][i] || isAdminOrMod,
|
|
|
|
|
read: results.read[i] || isAdminOrMod,
|
|
|
|
|
};
|
|
|
|
|
});
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
callback(null, privileges);
|
|
|
|
|
});
|
|
|
|
|
next(null, privileges);
|
|
|
|
|
},
|
|
|
|
|
], callback);
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
privileges.posts.can = function (privilege, pid, uid, callback) {
|
|
|
|
|
posts.getCidByPid(pid, function (err, cid) {
|
|
|
|
|
if (err) {
|
|
|
|
|
return callback(err);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
privileges.categories.can(privilege, cid, uid, callback);
|
|
|
|
|
});
|
|
|
|
|
async.waterfall([
|
|
|
|
|
function (next) {
|
|
|
|
|
posts.getCidByPid(pid, next);
|
|
|
|
|
},
|
|
|
|
|
function (cid, next) {
|
|
|
|
|
privileges.categories.can(privilege, cid, uid, next);
|
|
|
|
|
},
|
|
|
|
|
], callback);
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
privileges.posts.filter = function (privilege, pids, uid, callback) {
|
|
|
|
@ -136,19 +132,21 @@ module.exports = function (privileges) {
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
privileges.posts.canEdit = function (pid, uid, callback) {
|
|
|
|
|
async.waterfall([
|
|
|
|
|
function (next) {
|
|
|
|
|
async.parallel({
|
|
|
|
|
isEditable: async.apply(isPostEditable, pid, uid),
|
|
|
|
|
isAdminOrMod: async.apply(isAdminOrMod, pid, uid),
|
|
|
|
|
}, function (err, results) {
|
|
|
|
|
if (err) {
|
|
|
|
|
return callback(err);
|
|
|
|
|
}
|
|
|
|
|
}, next);
|
|
|
|
|
},
|
|
|
|
|
function (results, next) {
|
|
|
|
|
if (results.isAdminOrMod) {
|
|
|
|
|
return callback(null, { flag: true });
|
|
|
|
|
return next(null, { flag: true });
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
callback(null, results.isEditable);
|
|
|
|
|
});
|
|
|
|
|
next(null, results.isEditable);
|
|
|
|
|
},
|
|
|
|
|
], callback);
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
privileges.posts.canDelete = function (pid, uid, callback) {
|
|
|
|
@ -166,40 +164,42 @@ module.exports = function (privileges) {
|
|
|
|
|
'posts:delete': async.apply(privileges.posts.can, 'posts:delete', pid, uid),
|
|
|
|
|
}, next);
|
|
|
|
|
},
|
|
|
|
|
], function (err, results) {
|
|
|
|
|
if (err) {
|
|
|
|
|
return callback(err);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function (results, next) {
|
|
|
|
|
if (results.isAdminOrMod) {
|
|
|
|
|
return callback(null, { flag: true });
|
|
|
|
|
return next(null, { flag: true });
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (results.isLocked) {
|
|
|
|
|
return callback(null, { flag: false, message: '[[error:topic-locked]]' });
|
|
|
|
|
return next(null, { flag: false, message: '[[error:topic-locked]]' });
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (!results['posts:delete']) {
|
|
|
|
|
return callback(null, { flag: false, message: '[[error:no-privileges]]' });
|
|
|
|
|
return next(null, { flag: false, message: '[[error:no-privileges]]' });
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
var postDeleteDuration = parseInt(meta.config.postDeleteDuration, 10);
|
|
|
|
|
if (postDeleteDuration && (Date.now() - parseInt(postData.timestamp, 10) > postDeleteDuration * 1000)) {
|
|
|
|
|
return callback(null, { flag: false, message: '[[error:post-delete-duration-expired, ' + meta.config.postDeleteDuration + ']]' });
|
|
|
|
|
return next(null, { flag: false, message: '[[error:post-delete-duration-expired, ' + meta.config.postDeleteDuration + ']]' });
|
|
|
|
|
}
|
|
|
|
|
var deleterUid = parseInt(postData.deleterUid, 10) || 0;
|
|
|
|
|
var flag = results.isOwner && (deleterUid === 0 || deleterUid === parseInt(postData.uid, 10));
|
|
|
|
|
callback(null, { flag: flag, message: '[[error:no-privileges]]' });
|
|
|
|
|
});
|
|
|
|
|
next(null, { flag: flag, message: '[[error:no-privileges]]' });
|
|
|
|
|
},
|
|
|
|
|
], callback);
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
privileges.posts.canMove = function (pid, uid, callback) {
|
|
|
|
|
posts.isMain(pid, function (err, isMain) {
|
|
|
|
|
if (err || isMain) {
|
|
|
|
|
return callback(err || new Error('[[error:cant-move-mainpost]]'));
|
|
|
|
|
async.waterfall([
|
|
|
|
|
function (next) {
|
|
|
|
|
posts.isMain(pid, next);
|
|
|
|
|
},
|
|
|
|
|
function (isMain, next) {
|
|
|
|
|
if (isMain) {
|
|
|
|
|
return next(new Error('[[error:cant-move-mainpost]]'));
|
|
|
|
|
}
|
|
|
|
|
isAdminOrMod(pid, uid, callback);
|
|
|
|
|
});
|
|
|
|
|
isAdminOrMod(pid, uid, next);
|
|
|
|
|
},
|
|
|
|
|
], callback);
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
privileges.posts.canPurge = function (pid, uid, callback) {
|
|
|
|
@ -251,13 +251,14 @@ module.exports = function (privileges) {
|
|
|
|
|
function isAdminOrMod(pid, uid, callback) {
|
|
|
|
|
helpers.some([
|
|
|
|
|
function (next) {
|
|
|
|
|
posts.getCidByPid(pid, function (err, cid) {
|
|
|
|
|
if (err || !cid) {
|
|
|
|
|
return next(err, false);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
async.waterfall([
|
|
|
|
|
function (next) {
|
|
|
|
|
posts.getCidByPid(pid, next);
|
|
|
|
|
},
|
|
|
|
|
function (cid, next) {
|
|
|
|
|
user.isModerator(uid, cid, next);
|
|
|
|
|
});
|
|
|
|
|
},
|
|
|
|
|
], next);
|
|
|
|
|
},
|
|
|
|
|
function (next) {
|
|
|
|
|
user.isAdministrator(uid, next);
|
|
|
|
|