From ebc4912adad643d021df5b0356c99ebb9195d88a Mon Sep 17 00:00:00 2001 From: Alec Date: Thu, 24 Jan 2019 13:06:56 -0500 Subject: [PATCH] [ticket/15951] Add core.mcp_modify_permissions Allow non staff to access mcp functions This event would allow normal users to delete topics, for example If extensions need normal users to access this file they will need this event PHPBB3-15951 --- phpBB/mcp.php | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/phpBB/mcp.php b/phpBB/mcp.php index 23d2ce7d4e..865ab3e54c 100644 --- a/phpBB/mcp.php +++ b/phpBB/mcp.php @@ -116,15 +116,35 @@ if (!$auth->acl_getf_global('m_')) ); $allow_user = false; + $topic_info = phpbb_get_topic_data(array($topic_id)); if ($quickmod && isset($user_quickmod_actions[$action]) && $user->data['is_registered'] && $auth->acl_gets($user_quickmod_actions[$action], $forum_id)) { - $topic_info = phpbb_get_topic_data(array($topic_id)); if ($topic_info[$topic_id]['topic_poster'] == $user->data['user_id']) { $allow_user = true; } } + /** + * Allow modification of the permissions to access the mcp file + * + * @event core.mcp_modify_permissions + * @var array user_quickmod_actions Array holding the quickmod actions and their respectiev permissions + * @var array topic_info An array of the current topic's data + * @var bool allow_user Boolean holding if the user can access the mcp + * @var int forum_id The current forum ID + * @var int topic_id The current topic ID + * @since 3.2.6-RC1 + */ + $vars = array( + 'user_quickmod_actions', + 'topic_info', + 'allow_user', + 'forum_id', + 'topic_id', + ); + extract($phpbb_dispatcher->trigger_event('core.mcp_modify_permissions', compact($vars))); + if (!$allow_user) { send_status_line(403, 'Forbidden');