diff options
| author | Matthew Somerville <matthew@mysociety.org> | 2020-02-14 09:22:15 +0000 |
|---|---|---|
| committer | Matthew Somerville <matthew@mysociety.org> | 2020-02-14 09:22:15 +0000 |
| commit | f5744500d82c8a3cf2a70ce0544d778579b1694a (patch) | |
| tree | dc2e27b73cf97111754e273bff6bb256d9c9fee6 /perllib/FixMyStreet/App/Controller/Report.pm | |
| parent | 88e1827bd645f36be074f95eea25d1f539f1aecc (diff) | |
| parent | 3e00fa1c74c92bf902b1d41d524ad79a1554e835 (diff) | |
Merge branch 'private-in-email'
Diffstat (limited to 'perllib/FixMyStreet/App/Controller/Report.pm')
| -rw-r--r-- | perllib/FixMyStreet/App/Controller/Report.pm | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/perllib/FixMyStreet/App/Controller/Report.pm b/perllib/FixMyStreet/App/Controller/Report.pm index 7168e8379..72f96013a 100644 --- a/perllib/FixMyStreet/App/Controller/Report.pm +++ b/perllib/FixMyStreet/App/Controller/Report.pm @@ -160,7 +160,16 @@ sub load_problem_or_display_error : Private { $c->stash->{problem} = $problem; my $permissions = $c->stash->{_permissions} = $c->forward( 'check_has_permission_to', [ qw/report_inspect report_edit_category report_edit_priority report_mark_private / ] ); - if ( !$c->user || ($c->user->id != $problem->user->id && !($permissions->{report_inspect} || $permissions->{report_mark_private})) ) { + + # If someone has clicked a unique token link in an email to them + my $from_email = $c->sessionid && $c->flash->{alert_to_reporter} && $c->flash->{alert_to_reporter} == $problem->id; + + my $allowed = 0; + $allowed = 1 if $from_email; + $allowed = 1 if $c->user_exists && $c->user->id == $problem->user->id; + $allowed = 1 if $permissions->{report_inspect} || $permissions->{report_mark_private}; + + unless ($allowed) { my $url = '/auth?r=report/' . $problem->id; $c->detach( '/page_error_403_access_denied', |