From d31b3e413a71607f6f9593f414892cace955fb1a Mon Sep 17 00:00:00 2001
From: nickago <ngonella@calpoly.edu>
Date: Thu, 16 Jul 2015 13:40:18 -0700
Subject: Moved admin checking into seperate function

---
 api/context.go | 10 ++++++++++
 api/post.go    | 20 +++++++-------------
 2 files changed, 17 insertions(+), 13 deletions(-)

(limited to 'api')

diff --git a/api/context.go b/api/context.go
index bea0fbeff..0c9dee5c3 100644
--- a/api/context.go
+++ b/api/context.go
@@ -265,6 +265,16 @@ func (c *Context) IsSystemAdmin() bool {
 	return false
 }
 
+func (c *Context) IsTeamAdmin() bool {
+	if uresult := <-Srv.Store.User().Get(c.Session.UserId); uresult.Err != nil {
+		c.Err = uresult.Err
+		return false
+	} else {
+		user := uresult.Data.(*model.User)
+		return strings.Contains(user.Roles, model.ROLE_ADMIN) && user.TeamId == c.Session.TeamId
+	}
+}
+
 func (c *Context) RemoveSessionCookie(w http.ResponseWriter) {
 
 	sessionCache.Remove(c.Session.Id)
diff --git a/api/post.go b/api/post.go
index 0a8b5a20b..214429bb9 100644
--- a/api/post.go
+++ b/api/post.go
@@ -619,23 +619,17 @@ func deletePost(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	cchan := Srv.Store.Channel().CheckPermissionsTo(c.Session.TeamId, channelId, c.Session.UserId)
 	pchan := Srv.Store.Post().Get(postId)
-	uchan := Srv.Store.User().Get(c.Session.UserId)
 
-	if uresult := <-uchan; uresult.Err != nil {
-		c.Err = uresult.Err
+	if !c.HasPermissionsToChannel(cchan, "deletePost") && !c.IsTeamAdmin(){
 		return
-	} else if presult := <-pchan; presult.Err != nil {
-		c.Err = presult.Err
+	}
+
+	if result := <-pchan; result.Err != nil {
+		c.Err = result.Err
 		return
 	} else {
 
-		user := uresult.Data.(*model.User)
-
-		if !c.HasPermissionsToChannel(cchan, "deletePost") && !strings.Contains(user.Roles,"admin"){
-			return
-		}
-
-		post := presult.Data.(*model.PostList).Posts[postId]
+		post := result.Data.(*model.PostList).Posts[postId]
 
 		if post == nil {
 			c.SetInvalidParam("deletePost", "postId")
@@ -648,7 +642,7 @@ func deletePost(c *Context, w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		if post.UserId != c.Session.UserId && !strings.Contains(user.Roles,"admin") {
+		if post.UserId != c.Session.UserId && !strings.Contains(c.Session.Roles,model.ROLE_ADMIN) {
 			c.Err = model.NewAppError("deletePost", "You do not have the appropriate permissions", "")
 			c.Err.StatusCode = http.StatusForbidden
 			return
-- 
cgit v1.2.3-1-g7c22