diff --git a/administrator/components/com_contact/controllers/contact.php b/administrator/components/com_contact/controllers/contact.php index 9a65904d90cb0..f8a11cf83b466 100644 --- a/administrator/components/com_contact/controllers/contact.php +++ b/administrator/components/com_contact/controllers/contact.php @@ -60,21 +60,29 @@ protected function allowAdd($data = array()) protected function allowEdit($data = array(), $key = 'id') { $recordId = (int) isset($data[$key]) ? $data[$key] : 0; - $categoryId = 0; - if ($recordId) + // Since there is no asset tracking, fallback to the component permissions. + if (!$recordId) { - $categoryId = (int) $this->getModel()->getItem($recordId)->catid; + return parent::allowEdit($data, $key); } - if ($categoryId) + // Get the item. + $item = $this->getModel()->getItem($recordId); + + // Since there is no item, return false. + if (empty($item)) { - // The category has been set. Check the category permissions. - return JFactory::getUser()->authorise('core.edit', $this->option . '.category.' . $categoryId); + return false; } - // Since there is no asset tracking, revert to the component permissions. - return parent::allowEdit($data, $key); + $user = JFactory::getUser(); + + // Check if can edit own core.edit.own. + $canEditOwn = $user->authorise('core.edit.own', $this->option . '.category.' . (int) $item->catid) && $item->created_by == $user->id; + + // Check the category core.edit permissions. + return $canEditOwn || $user->authorise('core.edit', $this->option . '.category.' . (int) $item->catid); } /**