Perform ACL checking on content deletion

Author: carlbennett

src/controllers/Comment/Delete.php

@@ -38,11 +38,18 @@ public function run(Router &$router) {
     $model->parent_type  = null;
     $model->title        = null;
     $model->user_session = UserSession::load($router);
+    $model->user         = (isset($model->user_session) ?
+                            new User($model->user_session->user_id) : null);
 
     try { $model->comment = new Comment($model->id); }
     catch (CommentNotFoundException $e) { $model->comment = null; }
     catch (InvalidArgumentException $e) { $model->comment = null; }
 
+    $model->acl_allowed = ($model->user &&
+      ($model->user->getOptionsBitmask() & User::OPTION_ACL_COMMENT_DELETE)
+      || ($model->user_session->user_id == $model->comment->getUserId())
+    );
+
     if ($model->comment === null) {
       $model->error = "NOT_FOUND";
     } else {

src/controllers/Document/Delete.php

@@ -35,6 +35,12 @@ public function run(Router &$router) {
     $model->id           = (isset($data["id"]) ? $data["id"] : null);
     $model->title        = null;
     $model->user_session = UserSession::load($router);
+    $model->user         = (isset($model->user_session) ?
+                            new User($model->user_session->user_id) : null);
+
+    $model->acl_allowed = ($model->user &&
+      $model->user->getOptionsBitmask() & User::OPTION_ACL_DOCUMENT_DELETE
+    );
 
     try { $model->document = new Document($model->id); }
     catch (DocumentNotFoundException $e) { $model->document = null; }
@@ -76,6 +82,11 @@ protected function tryDelete(Router &$router, DocumentDeleteModel &$model) {
     }
     CSRF::invalidate($csrf_id);
 
+    if (!$model->acl_allowed) {
+      $model->error = "ACL_NOT_SET";
+      return;
+    }
+
     $model->error = false;
 
     $id           = (int) $model->id;

src/controllers/News/Delete.php

@@ -35,6 +35,12 @@ public function run(Router &$router) {
     $model->news_post    = null;
     $model->title        = null;
     $model->user_session = UserSession::load($router);
+    $model->user         = (isset($model->user_session) ?
+                            new User($model->user_session->user_id) : null);
+
+    $model->acl_allowed = ($model->user &&
+      $model->user->getOptionsBitmask() & User::OPTION_ACL_NEWS_DELETE
+    );
 
     try { $model->news_post = new NewsPost($model->id); }
     catch (NewsPostNotFoundException $e) { $model->news_post = null; }
@@ -76,6 +82,11 @@ protected function tryDelete(Router &$router, NewsDeleteModel &$model) {
     }
     CSRF::invalidate($csrf_id);
 
+    if (!$model->acl_allowed) {
+      $model->error = "ACL_NOT_SET";
+      return;
+    }
+
     $model->error = false;
 
     $id           = (int) $model->id;