Add function postIsEditableByStudent see BT#10894

main/forum/editpost.php

@@ -56,11 +56,18 @@ $current_thread = get_thread_information($_GET['forum'], $_GET['thread']);
 $current_forum = get_forum_information($_GET['forum']);
 $current_forum_category = get_forumcategory_information($current_forum['forum_category']);
 $current_post = get_post_information($_GET['post']);
+if (empty($current_post)) {
+    api_not_allowed(true);
+}
 
 api_block_course_item_locked_by_gradebook($_GET['thread'], LINK_FORUM_THREAD);
 
-/* Header and Breadcrumbs */
+$isEditable = postIsEditableByStudent($current_forum, $current_post);
+if (!$isEditable) {
+    api_not_allowed(true);
+}
 
+/* Header and Breadcrumbs */
 if (isset($_SESSION['gradebook'])) {
     $gradebook = $_SESSION['gradebook'];
 }

main/forum/forumfunction.inc.php

@@ -6163,3 +6163,26 @@ function getCountPostsWithStatus($status, $forumInfo, $threadId = null)
 
     return $qb->getQuery()->getSingleScalarResult();
 }
+
+/**
+ * @param array $forum
+ * @param array $post
+ *
+ * @return bool
+ */
+function postIsEditableByStudent($forum, $post)
+{
+    if (api_is_platform_admin() || api_is_allowed_to_edit()) {
+        return true;
+    }
+
+    if ($forum['moderated'] == 1) {
+        if (is_null($post['status'])) {
+            return true;
+        } else {
+            return $post['status'] == CForumPost::STATUS_WAITING_MODERATION;
+        }
+    } else {
+        return true;
+    }
+}

main/forum/viewthread_nested.inc.php

@@ -121,9 +121,10 @@ foreach ($rows as $post) {
 
     if ((isset($groupInfo['iid']) && $tutorGroup) ||
         ($current_forum['allow_edit'] == 1 && $post['user_id'] == $userId) ||
-        (api_is_allowed_to_edit(false, true) && !(api_is_course_coach() && $current_forum['session_id'] != $sessionId))
+        (api_is_allowed_to_edit(false, true) &&
+        !(api_is_course_coach() && $current_forum['session_id'] != $sessionId))
     ) {
-        if ($locked == false) {
+        if ($locked == false && postIsEditableByStudent($current_forum, $post)) {
             $editUrl = api_get_path(WEB_CODE_PATH).'forum/editpost.php?'.api_get_cidreq();
             $editUrl .= "&forum=$clean_forum_id&thread=$clean_thread_id&post={$post['post_id']}&id_attach=$id_attach";