From 31bc8f119cd896f19085ea120b89356393d4f8e6 Mon Sep 17 00:00:00 2001 From: Michael Hamann Date: Tue, 24 May 2011 22:38:27 +0200 Subject: Check permissions + security token in lock + draft modification FS#2265 This disables lock and draft creation for pages the user can't edit. It additionally adds a security token to the draft creation and deletion request so - at least for logged in users - drafts can't be created, modified or deleted so easily anymore. --- inc/actions.php | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'inc/actions.php') diff --git a/inc/actions.php b/inc/actions.php index a36fdfd5b..ecf09036f 100644 --- a/inc/actions.php +++ b/inc/actions.php @@ -509,10 +509,14 @@ function act_edit($act){ if(!$DATE) $DATE = $INFO['meta']['date']['modified']; //check if locked by anyone - if not lock for my self - $lockedby = checklock($ID); - if($lockedby) return 'locked'; + //do not lock when the user can't edit anyway + if ($INFO['writable']) { + $lockedby = checklock($ID); + if($lockedby) return 'locked'; + + lock($ID); + } - lock($ID); return $act; } -- cgit v1.2.3