Won't fix Moderation queue doesn't use approveUnapprove permission

[PaulB]

Affected version

1.5.21

Anyone who can see an item in the moderation queue can approve or delete it. The permissions required to view a thread or post in the moderation queue are view, edit any, and delete any. approveUnapprove should probably be in there as well, but that's only used for the inline moderation tool. This seems unintentional. For threads, approveUnapprove is only checked by XenForo_Model_Thread#canApproveUnapproveThread. The only relevant use of that method is in XenForo_Model_Thread#canAlterThreadState, which is only used in XenForo_ControllerPublic_Thread.

 

[PaulB]

Patch for v1.5.21 (ID: 1052170) attached.

 

[Chris D]

We do feel the change is more semantically correct. Ironically, the approach in XF2 is similar. But, at this point, we don't want to go invalidating the assumptions people have about how their moderation queue currently works in XF1 so we will pass on this one on this occasion.