antville/antville
antville/antville
1
1
Fork 0
Code Issues 51 Pull requests 9 Projects Releases 9 Wiki Activity Actions

Allowed a privileged user to add, edit and delete memberships without restrictions (you know what you’re doing)

Browse source
This commit is contained in:
Tobi Schäfer 2015-04-12 14:18:30 +02:00
parent 65ffc80208
commit e01cecfe25
1 changed files with 3 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
code/Membership/Membership.js
View file

@ -132,9 +132,9 @@ Membership.prototype.getPermission = function(action) {
case 'contact': case 'contact':
return res.handlers.site.getPermission('main'); return res.handlers.site.getPermission('main');
case 'edit': case 'edit':
return Membership.require(Membership.OWNER) && (!this.require(Membership.OWNER) || this.site.members.owners.size() > 1); return User.require(User.PRIVILEGED) || Membership.require(Membership.OWNER) && (!this.require(Membership.OWNER) || this.site.members.owners.size() > 1);
case 'delete': case 'delete':
return (this.creator === session.user || Membership.require(Membership.OWNER)) && (!this.require(Membership.OWNER) || this.site.members.owners.size() > 1); return User.require(User.PRIVILEGED) || (this.creator === session.user || Membership.require(Membership.OWNER)) && (!this.require(Membership.OWNER) || this.site.members.owners.size() > 1);
} }
return false; return false;
} }
@ -178,13 +178,10 @@ Membership.prototype.edit_action = function() {
Membership.prototype.update = function(data) { Membership.prototype.update = function(data) {
if (!data.role) { if (!data.role) {
throw Error(gettext('Please choose a role for this member.')); throw Error(gettext('Please choose a role for this member.'));
} else if (this.user === session.user) {
throw Error(gettext('Sorry, you are not allowed to edit your own membership.'));
} else if (data.role !== this.role) { } else if (data.role !== this.role) {
this.role = data.role || Membership.SUBSCRIBER; this.role = data.role || Membership.SUBSCRIBER;
this.touch(); this.touch();
this.notify(req.action, this.creator.email, this.notify(req.action, this.creator.email, gettext('[{0}] Notification of membership change', root.title));
gettext('[{0}] Notification of membership change', root.title));
} }
return; return;
} }