From 07c0fcf30222f06fd669734db64d843436161443 Mon Sep 17 00:00:00 2001 From: Aevann Date: Fri, 15 Nov 2024 19:41:21 +0200 Subject: [PATCH] only give an error when its the same person --- files/routes/users.py | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/files/routes/users.py b/files/routes/users.py index a44fbcd95..c67a33d88 100644 --- a/files/routes/users.py +++ b/files/routes/users.py @@ -210,8 +210,11 @@ def transfer_currency(v, username, currency_name, apply_tax): def upvoters_downvoters(v, username, username2, cls, vote_cls, vote_dir, template, standalone): u = get_user(username, v=v) - kind = "posts" if cls == Post else "comments" - if not u.is_visible_to(v, 0, kind): stop(403) + + if username == username2: + kind = "posts" if cls == Post else "comments" + if not u.is_visible_to(v, 0, kind): stop(403) + id = u.id uid = get_user(username2, attributes=[User.id]).id @@ -277,8 +280,11 @@ def downvoters_comments(v, username, username2): def upvoting_downvoting(v, username, username2, cls, vote_cls, vote_dir, template, standalone): u = get_user(username, v=v) - kind = "posts" if cls == Post else "comments" - if not u.is_visible_to(v, 0, kind): stop(403) + + if username == username2: + kind = "posts" if cls == Post else "comments" + if not u.is_visible_to(v, 0, kind): stop(403) + id = u.id uid = get_user(username2, attributes=[User.id]).id