jaculabilis/danbooru
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Added privilege check for seeing flagger usernames

Browse Source 
Also reworked all places dealing with flagger names to use said privilege
This commit is contained in:
Type-kun
2017-06-14 20:43:25 +05:00
parent 5d4592e0e0
commit 1375cc5307
8 changed files with 42 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
app/models/post_flag.rb
View File

@@ -65,12 +65,15 @@ class PostFlag < ActiveRecord::Base
q = q.reason_matches(params[:reason_matches])
end
if params[:creator_id].present? && (CurrentUser.is_moderator? || params[:creator_id].to_i == CurrentUser.user.id)
if params[:creator_id].present? && CurrentUser.can_view_flagger?(params[:creator_id].to_i)
q = q.where("creator_id = ?", params[:creator_id].to_i)
end
if params[:creator_name].present? && (CurrentUser.is_moderator? || params[:creator_name].mb_chars.downcase.strip.tr(" ", "_") == CurrentUser.user.name.downcase)
q = q.where("creator_id = (select _.id from users _ where lower(_.name) = ?)", params[:creator_name].mb_chars.downcase.strip.tr(" ", "_"))
if params[:creator_name].present?
creator_id = User.name_to_id(params[:creator_name].strip)
if CurrentUser.can_view_flagger?(creator_id)
q = q.where("creator_id = ?", creator_id)
end
end
if params[:post_id].present?