Skip to content

[3.0] Posting as regular user triggers permission error #8771

@jdarwood007

Description

@jdarwood007

SMF/Sources/Msg.php

Lines 1502 to 1507 in 68070df

if ($msgOptions['approved']) {
$board->num_posts++;
$board->save();
} else {
$board->unapproved_posts++;
$board->save();

This logic here triggers a permission error due to SMf\Board::save() checking permissions

SMF/Sources/Board.php

Lines 505 to 507 in 68070df

public function save(array $boardOptions = []): void
{
User::$me->isAllowedTo('manage_boards');

@Sesquipedalian, The best fix is to let save() ignore permission checks. But we should be careful about what we allow them to be saved when skipping a permission check. Or we do a separate SMF\Board::increase('msg', approved: true); that can still issue this in a logical sense.

This was introduced in #8502

Metadata

Metadata

Assignees

No one assigned

    Type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions