nodebb-plugin-composer-default 10.2.39 → 10.2.41

package/library.js

@@ -130,6 +130,9 @@ plugin.filterComposerBuild = async function (hookData) {
 	} else if (!req.query.pid && !req.query.tid && !req.query.cid) {
 		return helpers.redirect(res, '/');
 	}
+
+	await checkPrivileges(req, res);
+
 	const [
 		isMainPost,
 		postData,
@@ -224,6 +227,18 @@ plugin.filterComposerBuild = async function (hookData) {
 	};
 };
 
+async function checkPrivileges(req, res) {
+	const notAllowed = (
+		(req.query.cid && !await privileges.categories.can('topics:create', req.query.cid, req.uid)) ||
+		(req.query.tid && !await privileges.topics.can('topics:reply', req.query.tid, req.uid)) ||
+		(req.query.pid && !await privileges.posts.can('posts:edit', req.query.pid, req.uid))
+	);
+
+	if (notAllowed) {
+		await helpers.notAllowed(req, res);
+	}
+}
+
 function generateDiscardRoute(req, topicData) {
 	if (req.query.cid) {
 		return `${nconf.get('relative_path')}/category/${validator.escape(String(req.query.cid))}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-composer-default",
-  "version": "10.2.39",
+  "version": "10.2.41",
   "description": "Default composer for NodeBB",
   "main": "library.js",
   "repository": {

package/static/lib/composer/preview.js

@@ -51,7 +51,7 @@ define('composer/preview', ['hooks'], function (hooks) {
 		const showText = toggler.querySelector('.show-text');
 		const hideText = toggler.querySelector('.hide-text');
 		const previewToggled = localStorage.getItem('composer:previewToggled');
-		const hidePreviewOnOpen = config['composer-default'].hidePreviewOnOpen === 'on';
+		const hidePreviewOnOpen = config['composer-default'] && config['composer-default'].hidePreviewOnOpen === 'on';
 		let show = !isMobile && (
 			((previewToggled === null && !hidePreviewOnOpen) || previewToggled === 'true')
 		);