hiro/Vulcan
1
0
Fork 0
mirror of https://github.com/vale981/Vulcan synced 2025-03-06 10:01:40 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

make comment's postId uneditable in schema (fix #1231)

Browse source
This commit is contained in:
Sacha Greif 2016-02-06 11:09:10 +09:00
parent bb23d9b8b2
commit baa38bfa40
2 changed files with 9 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
packages/telescope-comments/lib/comments.js
View file

@ -143,7 +143,7 @@ Comments.schema = new SimpleSchema({
optional: true,
// regEx: SimpleSchema.RegEx.Id,
max: 500,
editableBy: ["member", "admin"], // TODO: should users be able to set postId, but not modify it?
// editableBy: ["member", "admin"], // TODO: should users be able to set postId, but not modify it?
autoform: {
omit: true // never show this
}

11
packages/telescope-comments/lib/methods.js
View file

@ -111,9 +111,14 @@ Meteor.methods({
// clear restricted properties
_.keys(comment).forEach(function (fieldName) {
var field = schema[fieldName];
if (!Users.can.submitField(user, field)) {
throw new Meteor.Error("disallowed_property", i18n.t('disallowed_property_detected') + ": " + fieldName);
// make an exception for postId, which should be setable but not modifiable
if (fieldName === "postId") {
// ok
} else {
var field = schema[fieldName];
if (!Users.can.submitField(user, field)) {
throw new Meteor.Error("disallowed_property", i18n.t('disallowed_property_detected') + ": " + fieldName);
}
}
});