carpathianflorist
/
MarseyWorld
forked from MarseyWorld/MarseyWorld
1
0
Fork 0
Code Pull Requests Activity

don't let users comment on things they can't see

master
justcool393 2022-10-07 03:22:07 -07:00
parent 48384ba8e5
commit 0627a12bc5
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
files/routes/comments.py
View File

@ -164,6 +164,7 @@ def comment(v):
if parent.author_id == v.id: rts = True if parent.author_id == v.id: rts = True
else: abort(400) else: abort(400)
if not parent.can_see(v): abort(404)
if parent.deleted_utc != 0: abort(404) if parent.deleted_utc != 0: abort(404)
body = request.values.get("body", "").strip().replace('‎','') body = request.values.get("body", "").strip().replace('‎','')