restrict all pool-related functions to logged in users only

Giraffaman · Feb 25, 2024 · 6a13b6d · 6a13b6d
1 parent 712a653
commit 6a13b6d
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 4 deletions.
diff --git a/core/permissions.php b/core/permissions.php
@@ -130,6 +130,8 @@ abstract class Permissions
     public const POOLS_ADMIN = "pools_admin";
     public const POOLS_CREATE = "pools_create";
     public const POOLS_UPDATE = "pools_update";
+    # 2024-02-25: added pool view permission to restrict to logged in users only
+    public const POOLS_VIEW = "pools_view";
 
     public const SET_PRIVATE_IMAGE = "set_private_image";
     public const SET_OTHERS_PRIVATE_IMAGES = "set_others_private_images";

diff --git a/core/userclass.php b/core/userclass.php
@@ -128,6 +128,8 @@ public function can(string $ability): bool
     Permissions::NOTES_REQUEST => true,
     Permissions::POOLS_CREATE => true,
     Permissions::POOLS_UPDATE => true,
+    # 2024-02-25: added permissions to view pools and tags to restrict this to logged in users only
+    Permissions::POOLS_VIEW => true,
 ]);
 
 new UserClass("hellbanned", "user", [

diff --git a/ext/pools/main.php b/ext/pools/main.php
@@ -232,10 +232,7 @@ public function onPageSubNavBuilding(PageSubNavBuildingEvent $event): void
     public function onPageRequest(PageRequestEvent $event): void
     {
         global $config, $database, $page, $user;
-        if(! $user->is_logged_in()) {
-            $errMessage = "You must be registered and logged in to use pools.";
-            $this->theme->display_error(401, "Unauthorized", $errMessage);
-        } else {
+        if($event->page_matches("pool", permission: Permissions::POOLS_VIEW)) {
             if (
                 $event->page_matches("pool/list", paged: true)
                 || $event->page_matches("pool/list/{search}", paged: true)