Covered "make revert" functionality with ACL permissions

misago/threads/acl.py

@@ -312,6 +312,28 @@ class ThreadsACL(BaseACL):
         except KeyError:
             raise ACLError403(_("You don't have permission to see history of changes made to this post."))
         
+    def can_make_revert(self, forum, thread):
+        try:
+            forum_role = self.acl[forum.pk]
+            if not forum_role['can_close_threads'] and (forum.closed or thread.closed):
+                return False
+            return forum_role['can_edit_threads_posts']
+        except KeyError:
+            return False
+    
+    def allow_revert(self, forum, thread):
+        try:
+            forum_role = self.acl[forum.pk]
+            if not forum_role['can_close_threads']:
+                if forum.closed:
+                    raise ACLError403(_("You can't make reverts in closed forums."))
+                if thread.closed:
+                    raise ACLError403(_("You can't make reverts in closed threads."))
+            if not forum_role['can_edit_threads_posts']:
+                raise ACLError403(_("You don't have permission to make reverts in this forum."))
+        except KeyError:
+            raise ACLError403(_("You don't have permission to make reverts in this forum."))
+            
     def can_mod_threads(self, forum):
         try:
             forum_role = self.acl[forum.pk]

misago/threads/views/changelog.py

@@ -72,6 +72,7 @@ class ChangelogDiffView(ChangelogBaseView):
             prev = self.post.change_set.filter(id__lt=self.change.pk).order_by('-id')[:1][0]
         except IndexError:
             prev = None
+        self.forum.closed = self.proxy.closed
         return request.theme.render_to_response('threads/changelog_diff.html',
                                                 {
                                                  'forum': self.forum,
@@ -89,7 +90,12 @@ class ChangelogDiffView(ChangelogBaseView):
 
 
 class ChangelogRevertView(ChangelogDiffView):
-    def dispatch(self, request, **kwargs):
+    def fetch_target(self, kwargs):
+        super(ChangelogDiffView, self).fetch_target(kwargs)
+        self.change = self.post.change_set.get(pk=kwargs['change'])
+        self.request.acl.threads.allow_revert(self.proxy, self.thread)
+        
+    def dispatch(self, request, **kwargs):        
         if ((not self.change.thread_name_old or self.thread.name == self.change.thread_name_old)
             and (self.change.post_content == self.post.post)):
             request.messages.set_flash(Message(_("No changes to revert.")), 'error', 'changelog')

templates/sora/threads/changelog_diff.html

@@ -45,7 +45,7 @@
 {% if acl.threads.can_edit_reply(user, forum, thread, post) or prev or next %}
 <div class="list-nav">
   {{ pager() }}
-  {% if user.is_authenticated() and acl.threads.can_edit_reply(user, forum, thread, post) %}
+  {% if user.is_authenticated() and acl.threads.can_make_revert(forum, thread) %}
   <form class="form-inline" action="{% url 'changelog_revert' thread=thread.pk, slug=thread.slug, post=post.pk, change=change.pk %}" method="post">
     <input type="hidden" name="{{ csrf_id }}" value="{{ csrf_token }}">
     <ul class="nav nav-pills pull-right">