Correctly check permissions on message edition and changelog view #22

misago/threads/acl.py

@@ -238,7 +238,8 @@ class ThreadsACL(BaseACL):
     def allow_thread_edit(self, user, forum, thread, post):
         try:
             forum_role = self.acl[thread.forum_id]
-            self.allow_deleted_post_view(forum)
+            if thread.deleted or post.deleted:
+                self.allow_deleted_post_view(forum)
             if not forum_role['can_close_threads']:
                 if forum.closed:
                     raise ACLError403(_("You can't edit threads in closed forums."))
@@ -294,7 +295,8 @@ class ThreadsACL(BaseACL):
     def allow_reply_edit(self, user, forum, thread, post):
         try:
             forum_role = self.acl[thread.forum_id]
-            self.allow_deleted_post_view(forum)
+            if thread.deleted or post.deleted:
+                self.allow_deleted_post_view(forum)
             if not forum_role['can_close_threads']:
                 if forum.closed:
                     raise ACLError403(_("You can't edit replies in closed forums."))
@@ -320,7 +322,8 @@ class ThreadsACL(BaseACL):
     def allow_changelog_view(self, user, forum, post):
         try:
             forum_role = self.acl[forum.pk]
-            self.allow_deleted_post_view(forum)
+            if post.thread.deleted or post.deleted:
+                self.allow_deleted_post_view(forum)
             if not (forum_role['can_see_changelog'] or user.pk == post.user_id):
                 raise ACLError403(_("You don't have permission to see history of changes made to this post."))
         except KeyError:

misago/threads/views/changelog.py

@@ -21,6 +21,7 @@ class ChangelogBaseView(BaseView):
         self.request.acl.threads.allow_thread_view(self.request.user, self.thread)
         self.parents = Forum.objects.forum_parents(self.forum.pk, True)
         self.post = Post.objects.select_related('user').get(pk=kwargs['post'], thread=self.thread.pk)
+        self.post.thread = self.thread
         self.request.acl.threads.allow_post_view(self.request.user, self.thread, self.post)
         self.request.acl.threads.allow_changelog_view(self.request.user, self.forum, self.post)