diff --git a/main/forum/editpost.php b/main/forum/editpost.php index 0bf6080c64..108bae9875 100755 --- a/main/forum/editpost.php +++ b/main/forum/editpost.php @@ -56,11 +56,18 @@ $current_thread = get_thread_information($_GET['forum'], $_GET['thread']); $current_forum = get_forum_information($_GET['forum']); $current_forum_category = get_forumcategory_information($current_forum['forum_category']); $current_post = get_post_information($_GET['post']); +if (empty($current_post)) { + api_not_allowed(true); +} api_block_course_item_locked_by_gradebook($_GET['thread'], LINK_FORUM_THREAD); -/* Header and Breadcrumbs */ +$isEditable = postIsEditableByStudent($current_forum, $current_post); +if (!$isEditable) { + api_not_allowed(true); +} +/* Header and Breadcrumbs */ if (isset($_SESSION['gradebook'])) { $gradebook = $_SESSION['gradebook']; } diff --git a/main/forum/forumfunction.inc.php b/main/forum/forumfunction.inc.php index 5184447a96..5c558b49af 100755 --- a/main/forum/forumfunction.inc.php +++ b/main/forum/forumfunction.inc.php @@ -6163,3 +6163,26 @@ function getCountPostsWithStatus($status, $forumInfo, $threadId = null) return $qb->getQuery()->getSingleScalarResult(); } + +/** + * @param array $forum + * @param array $post + * + * @return bool + */ +function postIsEditableByStudent($forum, $post) +{ + if (api_is_platform_admin() || api_is_allowed_to_edit()) { + return true; + } + + if ($forum['moderated'] == 1) { + if (is_null($post['status'])) { + return true; + } else { + return $post['status'] == CForumPost::STATUS_WAITING_MODERATION; + } + } else { + return true; + } +} \ No newline at end of file diff --git a/main/forum/viewthread_nested.inc.php b/main/forum/viewthread_nested.inc.php index 4343b098aa..7e11857279 100755 --- a/main/forum/viewthread_nested.inc.php +++ b/main/forum/viewthread_nested.inc.php @@ -121,9 +121,10 @@ foreach ($rows as $post) { if ((isset($groupInfo['iid']) && $tutorGroup) || ($current_forum['allow_edit'] == 1 && $post['user_id'] == $userId) || - (api_is_allowed_to_edit(false, true) && !(api_is_course_coach() && $current_forum['session_id'] != $sessionId)) + (api_is_allowed_to_edit(false, true) && + !(api_is_course_coach() && $current_forum['session_id'] != $sessionId)) ) { - if ($locked == false) { + if ($locked == false && postIsEditableByStudent($current_forum, $post)) { $editUrl = api_get_path(WEB_CODE_PATH).'forum/editpost.php?'.api_get_cidreq(); $editUrl .= "&forum=$clean_forum_id&thread=$clean_thread_id&post={$post['post_id']}&id_attach=$id_attach";