| @@ 321-323 (lines=3) @@ | ||
| 318 | $new = $record->id === null; |
|
| 319 | ||
| 320 | // reject edit published items and items from other authors |
|
| 321 | if (($new === false && (int)$record->author_id !== App::$User->identity()->getId()) || (int)$record->display === 1) { |
|
| 322 | throw new ForbiddenException(__('You have no permissions to edit this content')); |
|
| 323 | } |
|
| 324 | ||
| 325 | // initialize model |
|
| 326 | $model = new FormNarrowContentUpdate($record, $configs); |
|
| @@ 130-136 (lines=7) @@ | ||
| 127 | // check if action is submited |
|
| 128 | if (App::$Request->request->get('closeRequest', false)) { |
|
| 129 | // if created by authorized user |
|
| 130 | if ((int)$record->user_id !== 0) { |
|
| 131 | $user = App::$User->identity(); |
|
| 132 | // button is pressed not by request creator |
|
| 133 | if ($user === null || $user->getId() !== (int)$record->user_id) { |
|
| 134 | throw new ForbiddenException(__('This feedback request was created by another user')); |
|
| 135 | } |
|
| 136 | } |
|
| 137 | ||
| 138 | // switch closed to 1 and make sql query |
|
| 139 | $record->closed = 1; |
|