MDL-64525 comments: Should not be able to delete frozen comments

Before this change in a frozen context a user would be able to delete
their own comments.

After this change a user will only be able to delete their own comments
if they still have the capability to post new comments or the capability
to delete comments from any user.
This commit is contained in:
Neill Magill
2020-08-24 07:59:27 +01:00
parent 7603ca3080
commit 2987182e16
4 changed files with 43 additions and 16 deletions
+1 -1
View File
@@ -337,7 +337,7 @@ class core_comment_external extends external_api {
$args->area = $commentrecord->commentarea;
$manager = new comment($args);
if ($commentrecord->userid != $USER->id && !$manager->can_delete($commentrecord->id)) {
if (!$manager->can_delete($commentrecord)) {
throw new comment_exception('nopermissiontodelentry');
}