diff --git a/src/socket.io/groups.js b/src/socket.io/groups.js index 8301974a7d..a92fd4d5f5 100644 --- a/src/socket.io/groups.js +++ b/src/socket.io/groups.js @@ -325,13 +325,9 @@ SocketGroups.cover.update = function (socket, data, callback) { async.waterfall([ function (next) { - groups.ownership.isOwner(socket.uid, data.groupName, next); + canModifyGroup(socket.uid, data.groupName, next); }, - function (isOwner, next) { - if (!isOwner) { - return next(new Error('[[error:no-privileges]]')); - } - + function (next) { groups.updateCover(socket.uid, data, next); }, ], callback); @@ -344,14 +340,27 @@ SocketGroups.cover.remove = function (socket, data, callback) { async.waterfall([ function (next) { - groups.ownership.isOwner(socket.uid, data.groupName, next); + canModifyGroup(socket.uid, data.groupName, next); }, - function (isOwner, next) { - if (!isOwner) { - return next(new Error('[[error:no-privileges]]')); - } - + function (next) { groups.removeCover(data, next); }, ], callback); }; + +function canModifyGroup(uid, groupName, callback) { + async.waterfall([ + function (next) { + async.parallel({ + isOwner: async.apply(groups.ownership.isOwner, uid, groupName), + isAdminOrGlobalMod: async.apply(user.isAdminOrGlobalMod, uid), + }, next); + }, + function (results, next) { + if (!results.isOwner && !results.isAdminOrGlobalMod) { + return next(new Error('[[error:no-privileges]]')); + } + next(); + }, + ], callback); +}