diff --git a/src/privileges/categories.js b/src/privileges/categories.js index 397796b4a4..6f380b6563 100644 --- a/src/privileges/categories.js +++ b/src/privileges/categories.js @@ -110,6 +110,7 @@ module.exports = function (privileges) { return await utils.promiseParallel({ categories: categories.getCategoriesFields(cids, ['disabled']), allowedTo: helpers.isUserAllowedTo(privilege, uid, cids), + view_deleted: helpers.isUserAllowedTo('posts:view_deleted', uid, cids), isAdmin: user.isAdministrator(uid), }); }; diff --git a/src/privileges/posts.js b/src/privileges/posts.js index f8d824f943..ac595c0c31 100644 --- a/src/privileges/posts.js +++ b/src/privileges/posts.js @@ -88,16 +88,17 @@ module.exports = function (privileges) { cids = _.uniq(cids); const results = await privileges.categories.getBase(privilege, cids, uid); - cids = cids.filter(function (cid, index) { + const allowedCids = cids.filter(function (cid, index) { return !results.categories[index].disabled && (results.allowedTo[index] || results.isAdmin); }); - const cidsSet = new Set(cids); + const cidsSet = new Set(allowedCids); + const canViewDeleted = _.zipObject(cids, results.view_deleted); pids = postData.filter(function (post) { return post.topic && cidsSet.has(post.topic.cid) && - ((!post.topic.deleted && !post.deleted) || results.isAdmin); + ((!post.topic.deleted && !post.deleted) || canViewDeleted[post.topic.cid] || results.isAdmin); }).map(post => post.pid); const data = await plugins.fireHook('filter:privileges.posts.filter', { diff --git a/src/privileges/topics.js b/src/privileges/topics.js index af9e57698d..ee1f6b5ea1 100644 --- a/src/privileges/topics.js +++ b/src/privileges/topics.js @@ -68,14 +68,15 @@ module.exports = function (privileges) { } const topicsData = await topics.getTopicsFields(tids, ['tid', 'cid', 'deleted']); - let cids = _.uniq(topicsData.map(topic => topic.cid)); + const cids = _.uniq(topicsData.map(topic => topic.cid)); const results = await privileges.categories.getBase(privilege, cids, uid); - cids = cids.filter((cid, index) => !results.categories[index].disabled && (results.allowedTo[index] || results.isAdmin)); + const allowedCids = cids.filter((cid, index) => !results.categories[index].disabled && (results.allowedTo[index] || results.isAdmin)); - const cidsSet = new Set(cids); + const cidsSet = new Set(allowedCids); + const canViewDeleted = _.zipObject(cids, results.view_deleted); - tids = topicsData.filter(t => cidsSet.has(t.cid) && (!t.deleted || results.isAdmin)).map(t => t.tid); + tids = topicsData.filter(t => cidsSet.has(t.cid) && (!t.deleted || canViewDeleted[t.cid] || results.isAdmin)).map(t => t.tid); const data = await plugins.fireHook('filter:privileges.topics.filter', { privilege: privilege, diff --git a/src/topics/index.js b/src/topics/index.js index 7473f5754a..57f738b282 100644 --- a/src/topics/index.js +++ b/src/topics/index.js @@ -50,8 +50,7 @@ Topics.getTopics = async function (tids, options) { } tids = await privileges.topics.filterTids('topics:read', tids, uid); - const topics = await Topics.getTopicsByTids(tids, options); - return topics; + return await Topics.getTopicsByTids(tids, options); }; Topics.getTopicsByTids = async function (tids, options) {