Fix check permission of changing content to public from context menu (#…

…6836) * Fix check permission of changing content to public from context menu * Update CHANGELOG.md
humhub · Feb 5, 2024 · f04f034 · f04f034
1 parent 035f4c0
commit f04f034
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -15,6 +15,7 @@ HumHub Changelog
 - Fix #6126: `Session::$timeout` takes effect before configured `User::$authTimeout`
 - Fix #6795: Fix searching of disabled users in Administration
 - Fix #6834: Fix notification switcher in wall stream entry context menu
+- Fix #6836: Fix check permission of changing content to public from context menu
 
 1.15.2 (December 19, 2023)
 --------------------------

diff --git a/protected/humhub/modules/content/controllers/ContentController.php b/protected/humhub/modules/content/controllers/ContentController.php
@@ -207,7 +207,7 @@ public function actionToggleVisibility($id)
 
         if (!$content) {
             throw new NotFoundHttpException(Yii::t('ContentModule.base', 'Invalid content id given!'));
-        } elseif (!$content->canEdit()) {
+        } elseif (!$content->canEdit() || (!$content->visibility && !$content->container->visibility)) {
             throw new ForbiddenHttpException();
         } elseif ($content->isPrivate() && !$content->container->permissionManager->can(new CreatePublicContent())) {
             throw new ForbiddenHttpException();