Add missing vote permission check. Fixes #28

Also fix error messages not appearing on screen
FriendsOfFlarum · Dec 1, 2020 · 02cb46b · 02cb46b
1 parent f3c5dda
commit 02cb46b
Show file tree

Hide file tree

Showing 4 changed files with 5 additions and 3 deletions.
diff --git a/js/dist/forum.js b/js/dist/forum.js
diff --git a/js/dist/forum.js.map b/js/dist/forum.js.map
diff --git a/js/src/forum/components/DiscussionPoll.js b/js/src/forum/components/DiscussionPoll.js
@@ -107,7 +107,7 @@ export default class DiscussionPoll extends Component {
     onError(evt, error) {
         evt.target.checked = false;
 
-        app.alerts.show(error.alert);
+        throw error;
     }
 
     changeVote(option, evt) {

diff --git a/src/Commands/VotePollHandler.php b/src/Commands/VotePollHandler.php
@@ -46,6 +46,8 @@ public function handle(VotePoll $command)
 
         $optionId = Arr::get($data, 'optionId');
 
+        $actor->assertCan('votePolls');
+
         if ($poll->hasEnded()) {
             throw new PermissionDeniedException();
         }