1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Fixed Authors Response - Option To Delete Appears Even If User Does Not Have Permission

Discussion in 'Resource Manager Resolved Bugs' started by Divvens, Jul 10, 2016.

  1. Divvens

    Divvens Well-Known Member

    [​IMG]

    The user does not have permission to delete anything (regular user, not a moderator) however the delete option appears below the "Authors Response" - when clicked, it brings up an error saying the user does not have permission.

    Note, this only appears on the "Latest Reviews" page \ https://xenforo.com/community/resources/reviews

    Do I need to fix my permissions somewhere? Or is there a way to hide that delete button?
     
  2. Mike

    Mike XenForo Developer Staff Member

    If this is only appearing on one page, it's probably a bug. Will move it there for analysis.
     
    Divvens likes this.
  3. Divvens

    Divvens Well-Known Member

    It only appears on reviews left by the member viewing (and if it has an authors response).

    Steps;
    1 - Leave a review
    2- Have the author response
    3- When visiting the latest reviews page it'll show an option to delete the authors response, however when clicked gives an error overlay.

    Just if you needed more information.
     
  4. Mike

    Mike XenForo Developer Staff Member

    This is fixed now thanks. It's just a display bug, but if you want to fix it, in library/XenResource/Model/Rating.php, replace:
    Code:
            return (
                $resource['user_id'] == $viewingUser['user_id']
                || XenForo_Permission::hasContentPermission($categoryPermissions, 'deleteReviewAny')
            );
    
    With:
    Code:
            $userId = isset($resource['resource_user_id']) ? $resource['resource_user_id'] : $resource['user_id'];
    
            return (
                $userId == $viewingUser['user_id']
                || XenForo_Permission::hasContentPermission($categoryPermissions, 'deleteReviewAny')
            );
    
     
    Divvens likes this.

Share This Page