fix: #8508, dont allow moving topics if not moderator of target category

NodeBB · Jul 16, 2020 · 3653151 · 3653151
1 parent 1e14af4
commit 3653151
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/src/socket.io/topics/move.js b/src/socket.io/topics/move.js
@@ -13,6 +13,11 @@ module.exports = function (SocketTopics) {
 			throw new Error('[[error:invalid-data]]');
 		}
 
+		const canMove = await privileges.categories.isAdminOrMod(data.cid, socket.uid);
+		if (!canMove) {
+			throw new Error('[[error:no-privileges]]');
+		}
+
 		const uids = await user.getUidsFromSet('users:online', 0, -1);
 
 		await async.eachLimit(data.tids, 10, async function (tid) {