From 5bc0593ed6e772d48722c308ccb444dc49f3c079 Mon Sep 17 00:00:00 2001 From: Thomas Citharel Date: Mon, 8 Jan 2024 17:32:56 +0100 Subject: [PATCH] fix(graphql): fix checking actor identity when publishing event announcements Signed-off-by: Thomas Citharel --- lib/graphql/resolvers/participant.ex | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/lib/graphql/resolvers/participant.ex b/lib/graphql/resolvers/participant.ex index fb8803b71..2aa5ab7cf 100644 --- a/lib/graphql/resolvers/participant.ex +++ b/lib/graphql/resolvers/participant.ex @@ -381,10 +381,15 @@ defmodule Mobilizon.GraphQL.Resolvers.Participant do visibility: :private }) - with {:member, true} <- + with {:ok, + %Event{organizer_actor_id: organizer_actor_id, attributed_to_id: attributed_to_id} = + _event} <- Mobilizon.Events.get_event(event_id), + {:member, true} <- {:member, - to_string(current_actor_id) == to_string(actor_id) or - Actors.member?(current_actor_id, actor_id)}, + (to_string(current_actor_id) == to_string(organizer_actor_id) and + to_string(current_actor_id) == to_string(actor_id)) or + (!is_nil(attributed_to_id) and Actors.member?(current_actor_id, attributed_to_id) and + to_string(attributed_to_id) == to_string(actor_id))}, {:ok, _activity, %Conversation{} = conversation} <- Comments.create_conversation(args) do {:ok, conversation_to_view(conversation, Actors.get_actor(actor_id))} else