From f16908e9b96c4e1c8554d1e2f01faa39dcd456aa Mon Sep 17 00:00:00 2001 From: Monica Cellio Date: Tue, 28 Jul 2026 19:07:21 -0400 Subject: [PATCH 1/2] fixed voting access for restricted users --- app/controllers/votes_controller.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/app/controllers/votes_controller.rb b/app/controllers/votes_controller.rb index c270bcb1a..8016cdc4f 100644 --- a/app/controllers/votes_controller.rb +++ b/app/controllers/votes_controller.rb @@ -11,6 +11,12 @@ def create return end + if !current_user.privilege?('unrestricted') && !current_user.owns_post_or_parent?(post) + render(json: { status: 'failed', message: 'You must have the Participate Everywhere ability to vote on this post.' }, + status: :forbidden) + return + end + recent_votes = current_user.recent_votes_count max_votes_per_day = current_user.max_votes_per_day From ed002f423af776d9d7f3f5c7c41180c9ed833e15 Mon Sep 17 00:00:00 2001 From: Monica Cellio Date: Tue, 28 Jul 2026 19:54:48 -0400 Subject: [PATCH 2/2] localize strings for voting problems --- app/controllers/votes_controller.rb | 5 +++-- config/locales/strings/en.votes.yml | 5 ++++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/app/controllers/votes_controller.rb b/app/controllers/votes_controller.rb index 8016cdc4f..90dbab2c1 100644 --- a/app/controllers/votes_controller.rb +++ b/app/controllers/votes_controller.rb @@ -7,12 +7,13 @@ def create post = Post.find(params[:post_id]) if post.user == current_user && !SiteSetting['AllowSelfVotes'] - render(json: { status: 'failed', message: 'You may not vote on your own posts.' }, status: :forbidden) + render(json: { status: 'failed', message: I18n.t('votes.limits.own_post') }, + status: :forbidden) return end if !current_user.privilege?('unrestricted') && !current_user.owns_post_or_parent?(post) - render(json: { status: 'failed', message: 'You must have the Participate Everywhere ability to vote on this post.' }, + render(json: { status: 'failed', message: I18n.t('votes.limits.restricted_ability') }, status: :forbidden) return end diff --git a/config/locales/strings/en.votes.yml b/config/locales/strings/en.votes.yml index 485ef2f6f..4bd316b3e 100644 --- a/config/locales/strings/en.votes.yml +++ b/config/locales/strings/en.votes.yml @@ -1,4 +1,7 @@ en: votes: summary: - post_missing: 'Post not found' \ No newline at end of file + post_missing: 'Post not found' + limits: + own_post: 'You may not vote on your own posts.' + restricted_ability: 'You must have the Participate Everywhere ability to vote on this post.' \ No newline at end of file