Fixed Moderators can view the "Spam" button under the "Shared IP Addresses" tool, even if they don't have permission to run the spam cleaner

[SpecialK]

Affected version

2.1.4

We have confirmed this behavior with add-ons disabled and with the default XF 2.1 style. A user who is a moderator (And therefore sees the moderator tools) is able to see a "Spam" button in the Shared IP Addresses modal, even if they have no permission to actually use the tool. That same user DOES NOT see the "Spam" button under the "Moderator Tools" dropdown on a user's profile, so the permission appears to simply not be working in the Shared IP Addresses tool.

If the moderator clicks the "Spam" button, they receive a permission denied modal, so this isn't a huge deal, but it did lead to a couple of hours of back and forth troubleshooting.

Attached are two images showing that my user sees the spam button in the shared IPs dialog, but not in the moderator tools dropdown.

 

[XF Bug Bot]

Thank you for reporting this issue. It has now been resolved and we are aiming to include it in a future XF release (2.1.5).

Change log:

Only display "Spam" buttons to visitors who have permission to use the spam cleaner.

Any changes made as a result of this issue being resolved may not be rolled out here until later.