diff --git a/src/Cms/Controllers/Admin/PostController.php b/src/Cms/Controllers/Admin/PostController.php index 17383e3..b23aa4f 100644 --- a/src/Cms/Controllers/Admin/PostController.php +++ b/src/Cms/Controllers/Admin/PostController.php @@ -241,7 +241,7 @@ public function edit( array $parameters ): string } // Check permissions - if( !$user->isAdmin() && !$user->isEditor() && $post->getAuthor() !== $user->getUsername() ) + if( !$user->isAdmin() && !$user->isEditor() && $post->getAuthorId() !== $user->getId() ) { throw new \RuntimeException( 'Unauthorized to edit this post' ); } @@ -298,7 +298,7 @@ public function update( array $parameters ): string } // Check permissions - if( !$user->isAdmin() && !$user->isEditor() && $post->getAuthor() !== $user->getUsername() ) + if( !$user->isAdmin() && !$user->isEditor() && $post->getAuthorId() !== $user->getId() ) { throw new \RuntimeException( 'Unauthorized to edit this post' ); } @@ -367,7 +367,7 @@ public function destroy( array $parameters ): string } // Check permissions - if( !$user->isAdmin() && !$user->isEditor() && $post->getAuthor() !== $user->getUsername() ) + if( !$user->isAdmin() && !$user->isEditor() && $post->getAuthorId() !== $user->getId() ) { $sessionManager->flash( 'error', 'Unauthorized to delete this post' ); header( 'Location: /admin/posts' );