@@ 321-323 (lines=3) @@ | ||
318 | $new = $record->id === null; |
|
319 | ||
320 | // reject edit published items and items from other authors |
|
321 | if (($new === false && (int)$record->author_id !== App::$User->identity()->getId()) || (int)$record->display === 1) { |
|
322 | throw new ForbiddenException(__('You have no permissions to edit this content')); |
|
323 | } |
|
324 | ||
325 | // initialize model |
|
326 | $model = new FormNarrowContentUpdate($record, $configs); |
@@ 130-136 (lines=7) @@ | ||
127 | // check if action is submited |
|
128 | if (App::$Request->request->get('closeRequest', false)) { |
|
129 | // if created by authorized user |
|
130 | if ((int)$record->user_id !== 0) { |
|
131 | $user = App::$User->identity(); |
|
132 | // button is pressed not by request creator |
|
133 | if ($user === null || $user->getId() !== (int)$record->user_id) { |
|
134 | throw new ForbiddenException(__('This feedback request was created by another user')); |
|
135 | } |
|
136 | } |
|
137 | ||
138 | // switch closed to 1 and make sql query |
|
139 | $record->closed = 1; |