diff options
| -rw-r--r-- | routes/note_fragment.php | 3 | ||||
| -rw-r--r-- | templates/note.php | 2 |
2 files changed, 4 insertions, 1 deletions
diff --git a/routes/note_fragment.php b/routes/note_fragment.php index 143697f..9d3b9bb 100644 --- a/routes/note_fragment.php +++ b/routes/note_fragment.php @@ -20,6 +20,9 @@ Router::getInstance()->mount('/fragment/note/:id', function (array $args) { if ($note->author != $user->actor && !$user->isAdmin) { throw new Forbidden('you may not delete that note!'); } + if (!$note->author->isLocal) { + throw new BadRequest("can't delete a non-local note"); + } $note->markDeleted(); // no need to return any template because it's just gone diff --git a/templates/note.php b/templates/note.php index 74ce566..4d05554 100644 --- a/templates/note.php +++ b/templates/note.php @@ -99,7 +99,7 @@ if ($user != null) { global $note; $user = UserAccount::findByCurrentSession(); ?> - <?php if ($note->author == $user?->actor || $user?->isAdmin): ?> + <?php if ($note->author->isLocal && ($note->author == $user?->actor || $user?->isAdmin)): ?> <li> <button hx-delete="/fragment/note/<?= $note->id ?>" hx-confirm="<?= __('note.action.delete.confirmation') ?>" hx-target="closest .note" |