diff --git a/VKAPI/Handlers/Likes.php b/VKAPI/Handlers/Likes.php
index 11ab4700..11ad9743 100644
--- a/VKAPI/Handlers/Likes.php
+++ b/VKAPI/Handlers/Likes.php
@@ -70,9 +70,12 @@ final class Likes extends VKAPIRequestHandler
switch($type) {
case "post":
$user = (new UsersRepo)->get($user_id);
- if (is_null($user))
+ if(is_null($user))
$this->fail(100, "One of the parameters specified was missing or invalid: user not found");
+ if(!$user->canBeViewedBy($this->getUser()))
+ $this->fail(1983, "Access to user denied");
+
$post = (new PostsRepo)->getPostById($owner_id, $item_id);
if (is_null($post))
$this->fail(100, "One of the parameters specified was missing or invalid: object not found");
diff --git a/VKAPI/Handlers/Polls.php b/VKAPI/Handlers/Polls.php
index be947a44..3497120f 100755
--- a/VKAPI/Handlers/Polls.php
+++ b/VKAPI/Handlers/Polls.php
@@ -14,9 +14,12 @@ final class Polls extends VKAPIRequestHandler
{
$poll = (new PollsRepo)->get($poll_id);
- if (!$poll)
+ if(!$poll)
$this->fail(100, "One of the parameters specified was missing or invalid: poll_id is incorrect");
+ if(!$poll->canBeViewedBy($this->getUser()))
+ $this->fail(256, "Access to poll denied");
+
$users = array();
$answers = array();
foreach($poll->getResults()->options as $answer) {
@@ -73,6 +76,9 @@ final class Polls extends VKAPIRequestHandler
if(!$poll)
$this->fail(251, "Invalid poll id");
+ if(!$poll->canBeViewedBy($this->getUser()))
+ $this->fail(256, "Access to poll denied");
+
try {
$poll->vote($this->getUser(), explode(",", $answers_ids));
return 1;
@@ -95,6 +101,9 @@ final class Polls extends VKAPIRequestHandler
if(!$poll)
$this->fail(251, "Invalid poll id");
+ if(!$poll->canBeViewedBy($this->getUser()))
+ $this->fail(256, "Access to poll denied");
+
try {
$poll->revokeVote($this->getUser());
return 1;
diff --git a/Web/Models/Entities/Poll.php b/Web/Models/Entities/Poll.php
index 043b0eba..4ec48219 100644
--- a/Web/Models/Entities/Poll.php
+++ b/Web/Models/Entities/Poll.php
@@ -293,8 +293,8 @@ class Poll extends Attachable
}
}
- function canBeViewedBy(?User $user): bool
+ function canBeViewedBy(?User $user = NULL): bool
{
- return true;
+ return $this->getOwner()->canBeViewedBy($user);
}
}
diff --git a/Web/Presenters/PollPresenter.php b/Web/Presenters/PollPresenter.php
index 9c75e3bf..950459a8 100644
--- a/Web/Presenters/PollPresenter.php
+++ b/Web/Presenters/PollPresenter.php
@@ -19,6 +19,9 @@ final class PollPresenter extends OpenVKPresenter
$poll = $this->polls->get($id);
if(!$poll)
$this->notFound();
+
+ if(!$poll->canBeViewedBy($this->user->identity))
+ $this->notFound();
$this->template->id = $poll->getId();
$this->template->title = $poll->getTitle();
@@ -53,6 +56,9 @@ final class PollPresenter extends OpenVKPresenter
if(!$poll)
$this->notFound();
+ if(!$poll->canBeViewedBy($this->user->identity))
+ $this->notFound();
+
if($poll->isAnonymous())
$this->flashFail("err", tr("forbidden"), tr("poll_err_anonymous"));
diff --git a/Web/Presenters/templates/Group/View.xml b/Web/Presenters/templates/Group/View.xml
index 010edf67..7e120ba0 100644
--- a/Web/Presenters/templates/Group/View.xml
+++ b/Web/Presenters/templates/Group/View.xml
@@ -135,13 +135,12 @@
function banClub() {
let name = {$club->getName()}
let body = tr("ban_group_desc", {$club->getName()})
- let cool = tr("come_up_with_something_cool")
let num = {$club->getId()}
body += `
-
- ` + tr('delete_every_post') +
- `
` + tr('unsubscribe_everyoune')
+
+
+
`
MessageBox({_ban_group} + " " + {$club->getName()}, body, [{_ok}, {_cancel}], [
diff --git a/Web/Presenters/templates/User/View.xml b/Web/Presenters/templates/User/View.xml
index d2b16bda..e7c00ae1 100644
--- a/Web/Presenters/templates/User/View.xml
+++ b/Web/Presenters/templates/User/View.xml
@@ -110,6 +110,15 @@
{/if}
+ {if $thisUser->getChandlerUser()->can('write')->model('openvk\Web\Models\Entities\TicketReply')->whichBelongsTo(0)}
+
+ {if $user->isBannedInSupport()}
+ {_unban_in_support_user_action}
+ {else}
+ {_ban_in_support_user_action}
+ {/if}
+
+ {/if}