Merge pull request #214 from fullscreeninteractive/wilr-patch-1

If user cannot view record then prevent comment
2017-09-13 08:36:18 +12:00 · 2017-09-13 08:36:18 +12:00 · 4e2d22e16d
parent fb3cc1b861 85e8384151
commit 4e2d22e16d
1 changed files with 5 additions and 0 deletions
--- a/src/Extensions/CommentsExtension.php
+++ b/src/Extensions/CommentsExtension.php
@ -363,6 +363,11 @@ class CommentsExtension extends DataExtension
        if (!$this->owner->CommentsEnabled) {
            return false;
        }
+        
+        if (!$this->owner->canView($member)) {
+            // deny if current user cannot view the underlying record.
+            return false;
+        }

        // Check if member is required
        $requireLogin = $this->owner->CommentsRequireLogin;