From 1cf7a23267eef168d1d6ba2dd6039e754da206d8 Mon Sep 17 00:00:00 2001 From: dleffler Date: Thu, 26 Dec 2013 07:54:14 -0500 Subject: [PATCH] Restricts 'Approve' action to 'edit' perm...if you can't edit it, you can't approve it...e.g., if you can only create/edit your own items, you must not be allowed to 'approve' other items, nor should we default to allowing you to approve your own items unless granted permission. [#1058] --- framework/modules/text/views/text/showall.tpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/framework/modules/text/views/text/showall.tpl b/framework/modules/text/views/text/showall.tpl index fce221afce..f533a6f08b 100755 --- a/framework/modules/text/views/text/showall.tpl +++ b/framework/modules/text/views/text/showall.tpl @@ -48,7 +48,7 @@ {if $permissions.delete || ($permissions.create && $text->poster == $user->id)} {icon action=delete record=$text} {/if} - {if !$text->approved && $permissions.approve} + {if !$text->approved && $permissions.approve && $permissions.edit} {icon action=approve record=$text} {/if}