From e8cd6abc6e8921223a7a290088153bffc364e9d5 Mon Sep 17 00:00:00 2001
From: canyonknight <canyonknight@gmail.com>
Date: Thu, 9 Aug 2012 21:15:50 -0400
Subject: Allow only Trusted Users, Developers, and Maintainers to unflag
 packages

Currently everyone is allowed to unflag a package as out of date. This should
be limited to only the appropriate people for a specific package.

Fixes FS#27263

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
---
 web/lib/pkgfuncs.inc.php | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'web/lib')

diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php
index 6fad628d..c592e393 100644
--- a/web/lib/pkgfuncs.inc.php
+++ b/web/lib/pkgfuncs.inc.php
@@ -728,6 +728,10 @@ function pkg_flag ($atype, $ids, $action=true, $dbh=NULL) {
 	}
 	$q.= " WHERE ID IN (" . implode(",", $ids) . ")";
 
+	if (!$action && ($atype != "Trusted User" && $atype != "Developer")) {
+		$q.= "AND MaintainerUID = " . uid_from_sid($_COOKIE["AURSID"], $dbh);
+	}
+
 	db_query($q, $dbh);
 
 	if ($action) {
-- 
cgit v1.2.3-24-g4f1b