diff --git a/inc/Ajax.php b/inc/Ajax.php index b41c0baa..a9276d76 100644 --- a/inc/Ajax.php +++ b/inc/Ajax.php @@ -25,11 +25,12 @@ public function __construct() { } public function delete_comment() { + $comment = get_comment( $_GET['comment_id'] ); if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( $_GET['_wpnonce'] ), '_dwqa_delete_comment' ) ) { wp_die( __( 'Are you cheating huh?', 'dw-question-answer' ) ); } - if ( !dwqa_current_user_can( 'delete_comment' ) ) { + if ( !dwqa_current_user_can( 'delete_comment', $comment->comment_post_ID, $comment->comment_ID ) ) { wp_die( __( 'You do not have permission to edit comment.', 'dw-question-answer' ) ); } @@ -37,8 +38,7 @@ public function delete_comment() { wp_die( __( 'Comment ID must be showed.', 'dw-question-answer' ) ); } - wp_delete_comment( intval( $_GET['comment_id'] ) ); - $comment = get_comment( $_GET['comment_id'] ); + wp_delete_comment( intval( $comment->comment_ID ) ); exit( wp_safe_redirect( dwqa_get_question_link( $comment->comment_post_ID ) ) ); } @@ -168,7 +168,7 @@ public function delete_question() { wp_die( __( 'This post is not question.', 'dw-question-answer' ) ); } - if ( !dwqa_current_user_can( 'delete_answer' ) ) { + if ( !dwqa_current_user_can( 'delete_question', intval( $_GET['question_id'] ) ) ) { wp_die( __( 'You do not have permission to delete this post.', 'dw-question-answer' ) ); } @@ -301,4 +301,4 @@ public function posts_where_suggest( $where ) { } return $where; } -} \ No newline at end of file +} diff --git a/inc/Handle.php b/inc/Handle.php index b5f7b1b8..a0133ec8 100644 --- a/inc/Handle.php +++ b/inc/Handle.php @@ -137,7 +137,7 @@ public function insert_answer() { public function update_answer() { if ( isset( $_POST['dwqa-edit-answer-submit'] ) ) { - if ( !dwqa_current_user_can( 'edit_answer' ) ) { + if ( !dwqa_current_user_can( 'edit_answer', intval( $_POST['answer_id'] ) ) ) { dwqa_add_notice( __( "You do not have permission to edit answer.", 'dw-question-answer' ), 'error' ); } @@ -484,7 +484,7 @@ public function update_question() { if ( isset( $_POST['dwqa-edit-question-submit'] ) ) { if ( isset( $_POST['_wpnonce'] ) && wp_verify_nonce( esc_html( $_POST['_wpnonce'] ), '_dwqa_edit_question' ) ) { - if ( !dwqa_current_user_can( 'edit_question' ) ) { + if ( !dwqa_current_user_can( 'edit_question', intval( $_POST['question_id'] ) ) ) { dwqa_add_notice( __( "You do not have permission to edit question", 'dw-question-answer' ), 'error' ); } diff --git a/inc/Permission.php b/inc/Permission.php index 71688a5c..b006b7e0 100644 --- a/inc/Permission.php +++ b/inc/Permission.php @@ -1,7 +1,10 @@ user_id ) ) { $post_author = $comment->user_id; } @@ -38,9 +41,9 @@ function dwqa_user_can( $user_id, $perm, $post_id = false ) { return apply_filters( 'dwqa_user_can', $can, $perm, $user_id, $post_id ); } -function dwqa_current_user_can( $perm, $post_id = false ) { +function dwqa_current_user_can( $perm, $post_id = false, $comment_id = false ) { $current_user_id = get_current_user_id(); - $can = dwqa_user_can( $current_user_id, $perm, $post_id ); + $can = dwqa_user_can( $current_user_id, $perm, $post_id, $comment_id ); return apply_filters( 'dwqa_current_user_can', $can, $current_user_id, $perm, $post_id ); } @@ -427,4 +430,4 @@ public function restrict_single_question( $posts ) { } } -?> \ No newline at end of file +?> diff --git a/templates/assets/js/dwqa-single-question.js b/templates/assets/js/dwqa-single-question.js index cb043c93..4ad02bf9 100644 --- a/templates/assets/js/dwqa-single-question.js +++ b/templates/assets/js/dwqa-single-question.js @@ -108,9 +108,9 @@ }); }); - // delete question + // delete question, answer or comment $( '.dwqa_delete_question, .dwqa_delete_answer, .dwqa-delete-comment' ).on('click', function(e) { - var message = confirm( 'Are you sure to delete this question.' ); + var message = confirm( 'Are you sure to delete this item.' ); if ( !message ) { e.preventDefault(); @@ -175,4 +175,4 @@ current_form.find('.dwqa-form-submit').show(); }); -})(jQuery); \ No newline at end of file +})(jQuery); diff --git a/templates/content-comment.php b/templates/content-comment.php index 519a6f6a..29e3752a 100644 --- a/templates/content-comment.php +++ b/templates/content-comment.php @@ -15,10 +15,10 @@ user_id, true ); ?>
- + comment_ID ) ) : ?> - + comment_ID ) ) : ?>