authorisation check to request_title_change method

publiclab · Jan 14, 2018 · 06b292b · 06b292b
1 parent 61e5383
commit 06b292b
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/app/controllers/notes_controller.rb b/app/controllers/notes_controller.rb
@@ -336,6 +336,10 @@ def rsvp
 
   def request_title_change
     node = Node.find params[:id].to_i
+    unless current_user && current_user.drupal_user == node.author
+      flash.keep[:error] = I18n.t('notes_controller.author_can_edit_note')
+      redirect_to :back
+    end
     node.update(title: params[:title])
     redirect_to node.path + "#comments"
   end