Merge pull request #13776 from jeabakker/group-join

Group join
Elgg · Nov 16, 2021 · 048caee · 048caee
2 parents c6b1c5b + d9fcad7
commit 048caee
Show file tree

Hide file tree

Showing 5 changed files with 32 additions and 6 deletions.
diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,10 @@
+# Security policy
+
+- Please report any security issue to **security @ elgg . org**
+- Please do not post any security issues on GitHub
+- Read [Reporting issues][1] on how to correctly report an issue
+
+To see which versions of Elgg are currently supported, please check the [Support policy][2]
+
+[1]: http://learn.elgg.org/en/stable/contribute/issues.html
+[2]: http://learn.elgg.org/en/stable/appendix/support.html
diff --git a/mod/groups/actions/groups/membership/delete_invite.php b/mod/groups/actions/groups/membership/delete_invite.php
@@ -13,8 +13,12 @@
 	return get_entity($group_guid);
 });
 
-if (!$user && !($group instanceof \ElggGroup)) {
-	return elgg_error_response();
+if (!$user && !$group instanceof \ElggGroup) {
+	return elgg_error_response(elgg_echo('error:missing_data'));
+}
+
+if (!$user->canEdit() && !$group->canEdit()) {
+	return elgg_error_response(elgg_echo('actionunauthorized'));
 }
 
 // If join request made

diff --git a/mod/groups/actions/groups/membership/delete_request.php b/mod/groups/actions/groups/membership/delete_request.php
@@ -9,8 +9,12 @@
 $user = get_user($user_guid);
 $group = get_entity($group_guid);
 
-if (!$user && !($group instanceof \ElggGroup)) {
-	return elgg_error_response();
+if (!$user && !$group instanceof \ElggGroup) {
+	return elgg_error_response(elgg_echo('error:missing_data'));
+}
+
+if (!$user->canEdit() && !$group->canEdit()) {
+	return elgg_error_response(elgg_echo('actionunauthorized'));
 }
 
 // If join request made

diff --git a/mod/groups/actions/groups/membership/join.php b/mod/groups/actions/groups/membership/join.php
@@ -18,10 +18,14 @@
 	return get_entity($group_guid);
 });
 
-if (!$user || !($group instanceof \ElggGroup)) {
+if (!$user || !$group instanceof \ElggGroup) {
 	return elgg_error_response(elgg_echo('groups:cantjoin'));
 }
 
+if (!$user->canEdit() && !$group->canEdit()) {
+	return elgg_error_response(elgg_echo('actionunauthorized'));
+}
+
 // join or request
 $join = false;
 if ($group->isPublicMembership() || $group->canEdit($user->guid)) {

diff --git a/mod/groups/actions/groups/membership/leave.php b/mod/groups/actions/groups/membership/leave.php
@@ -9,10 +9,14 @@
 $user = get_user($user_guid);
 $group = get_entity($group_guid);
 
-if (!$user || !($group instanceof \ElggGroup)) {
+if (!$user || !$group instanceof \ElggGroup) {
 	return elgg_error_response(elgg_echo('groups:cantleave'));
 }
 
+if (!$user->canEdit() && !$group->canEdit()) {
+	return elgg_error_response(elgg_echo('actionunauthorized'));
+}
+
 if ($group->getOwnerGUID() === $user->guid) {
 	// owner can't be removed
 	return elgg_error_response(elgg_echo('groups:cantleave'));