Permalink
Browse files

Fix #8090 only owner of the wall can delete their own wall messages.

  • Loading branch information...
jmontoyaa committed Feb 16, 2016
1 parent aeb458a commit e45079df7a1bf31bbcdd9b1d22d8c23cf76fd1db
Showing with 13 additions and 6 deletions.
  1. +13 −6 main/social/profile.php
@@ -81,12 +81,19 @@
exit;
} else if (isset($_GET['messageId'])) {
$messageId = Security::remove_XSS($_GET['messageId']);
$status = SocialManager::deleteMessage($messageId);
Display::addFlash(Display::return_message(get_lang('MessageDeleted')));
header('Location: ' . api_get_path(WEB_CODE_PATH) . 'social/profile.php');
exit;
$messageId = intval($_GET['messageId']);
$messageInfo = MessageManager::get_message_by_id($messageId);
if (!empty($messageInfo)) {
// I can only delete messages of my own wall
if ($messageInfo['user_receiver_id'] == $user_id) {
$status = SocialManager::deleteMessage($messageId);
Display::addFlash(Display::return_message(get_lang('MessageDeleted')));
header('Location: ' . api_get_path(WEB_CODE_PATH) . 'social/profile.php');
exit;
}
}
api_not_allowed(true);
} else if (isset($_GET['u'])) { //I'm your friend? I can see your profile?
$user_id = intval($_GET['u']);
if (api_is_anonymous($user_id, true)) {

0 comments on commit e45079d

Please sign in to comment.