change torrent-delete permission judge

xiaomlove · Mar 2, 2024 · b32bdc1 · b32bdc1
1 parent e653fda
commit b32bdc1
Show file tree

Hide file tree

Showing 6 changed files with 122 additions and 77 deletions.
diff --git a/composer.json b/composer.json
@@ -43,12 +43,11 @@
         "imdbphp/imdbphp": "^7.0",
         "laravel/framework": "9.52.4",
         "laravel/octane": "^1.2",
-        "laravel/passport": "*",
+        "laravel/passport": "^11.10",
         "laravel/sanctum": "^2.10",
         "laravel/tinker": "^2.5",
         "league/flysystem-ftp": "^3.0",
         "league/flysystem-sftp-v3": "^3.0",
-        "league/uri": "6.8",
         "masbug/flysystem-google-drive-ext": "^2.0",
         "meilisearch/meilisearch-php": "^1.0",
         "orangehill/iseed": "^3.0",

diff --git a/composer.lock b/composer.lock
diff --git a/include/constants.php b/include/constants.php
@@ -1,6 +1,6 @@
 <?php
 defined('VERSION_NUMBER') || define('VERSION_NUMBER', '1.8.9');
-defined('RELEASE_DATE') || define('RELEASE_DATE', '2024-03-01');
+defined('RELEASE_DATE') || define('RELEASE_DATE', '2024-03-03');
 defined('IN_TRACKER') || define('IN_TRACKER', false);
 defined('PROJECTNAME') || define("PROJECTNAME","NexusPHP");
 defined('NEXUSPHPURL') || define("NEXUSPHPURL","https://nexusphp.org");

diff --git a/include/functions.php b/include/functions.php
@@ -3808,7 +3808,9 @@ function torrenttable($rows, $variant = "torrent", $searchBoxId = 0) {
 
 	if (user_can('torrentmanage'))
 	{
-		print("<td class=\"rowfollow\"><a href=\"".htmlspecialchars("fastdelete.php?id=".$row['id'])."\"><img class=\"staff_delete\" src=\"pic/trans.gif\" alt=\"D\" title=\"".$lang_functions['text_delete']."\" /></a>");
+        if (user_can('torrent-delete')) {
+            print("<td class=\"rowfollow\"><a href=\"".htmlspecialchars("fastdelete.php?id=".$row['id'])."\"><img class=\"staff_delete\" src=\"pic/trans.gif\" alt=\"D\" title=\"".$lang_functions['text_delete']."\" /></a>");
+        }
 		print("<br /><a href=\"edit.php?returnto=" . rawurlencode($_SERVER["REQUEST_URI"]) . "&amp;id=" . $row["id"] . "\"><img class=\"staff_edit\" src=\"pic/trans.gif\" alt=\"E\" title=\"".$lang_functions['text_edit']."\" /></a></td>\n");
 	}
 	print("</tr>\n");

diff --git a/public/edit.php b/public/edit.php
@@ -227,7 +227,7 @@
 	print("<tr><td class=\"toolbox\" colspan=\"2\" align=\"center\"><input id=\"qr\" type=\"submit\" value=\"".$lang_edit['submit_edit_it']."\" /> <input type=\"reset\" value=\"".$lang_edit['submit_revert_changes']."\" /></td></tr>\n");
 	print("</table>\n");
 	print("</form>\n");
-	if (user_can('torrent-delete')) {
+	if (user_can('torrent-delete') && user_can('torrentmanage')) {
         print("<br /><br />");
         print("<form method=\"post\" action=\"delete.php\">\n");
         print("<input type=\"hidden\" name=\"id\" value=\"$id\" />\n");