SAK-33403 Can only post via XHR if post.create is set. (sakaiproject#…

…4834)
Spencerx · Sep 26, 2017 · e8e8ee7 · e8e8ee7
1 parent 9357b4c
commit e8e8ee7
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/commons/impl/src/java/org/sakaiproject/commons/impl/CommonsSecurityManagerImpl.java b/commons/impl/src/java/org/sakaiproject/commons/impl/CommonsSecurityManagerImpl.java
@@ -17,6 +17,8 @@
 
 package org.sakaiproject.commons.impl;
 
+import org.apache.commons.lang.StringUtils;
+
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
@@ -95,8 +97,12 @@ public boolean canCurrentUserEditPost(Post post) {
         String currentUser = sakaiProxy.getCurrentUserId();
 
         // If the current user is authenticated and the post author, yes.
-        if (currentUser != null && currentUser.equals(post.getCreatorId()) && sakaiProxy.isAllowedFunction(CommonsFunctions.POST_UPDATE_OWN, post.getSiteId())) {
-            return true;
+        if (currentUser != null && currentUser.equals(post.getCreatorId())) {
+            if (StringUtils.isEmpty(post.getId())) {
+                return sakaiProxy.isAllowedFunction(CommonsFunctions.POST_CREATE, post.getSiteId());
+            } else {
+                return sakaiProxy.isAllowedFunction(CommonsFunctions.POST_UPDATE_OWN, post.getSiteId());
+            }
         }
 
         return false;