Changeset 2542 for trunk/bp-themes/bp-default/_inc/ajax.php

Timestamp:

02/02/2010 06:29:33 PM (15 years ago)

Author:

apeatling

Message:

Fixes #1767

File:

• trunk/bp-themes/bp-default/_inc/ajax.php (modified) (1 diff)

trunk/bp-themes/bp-default/_inc/ajax.php

@@ -156 +156 @@
     }
 
-    if ( empty( $_POST['id'] ) || !is_numeric( $_POST['id'] ) || !bp_activity_delete( array( 'id' => $_POST['id'] ) ) ) {
+    $activity = new BP_Activity_Activity( $_POST['id'] );
+
+    /* Check access */
+    if ( !is_site_admin() && $activity->user_id != $bp->loggedin_user->id )
+        return false;
+
+    if ( empty( $_POST['id'] ) || !is_numeric( $_POST['id'] ) || !bp_activity_delete( array( 'id' => $_POST['id'], 'user_id' => $activity->user_id ) ) ) {
         echo '-1<div id="message" class="error"><p>' . __( 'There was a problem when deleting. Please try again.', 'buddypress' ) . '</p></div>';
         return false;