Relax access for Controller_Rest_Comments::post_entity() to match std…

… UI.
gallery · Jun 13, 2013 · 5409b45 · 5409b45
1 parent 1fc3a7a
commit 5409b45
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/modules/comment/classes/Comment/Controller/Rest/Comments.php b/modules/comment/classes/Comment/Controller/Rest/Comments.php
@@ -61,7 +61,10 @@ static function post_entity($id, $params) {
     }
 
     $item = ORM::factory("Item", $i_id);
-    Access::required("edit", $item);
+    Access::required("view", $item);
+    if (!Comment::can_comment()) {
+      throw Rest_Exception::factory(403);
+    }
 
     // Build the comment model.
     $comment = ORM::factory("Comment");