fix voting access for restricted users

app/controllers/votes_controller.rb

@@ -7,7 +7,14 @@ def create
     post = Post.find(params[:post_id])
 
     if post.user == current_user && !SiteSetting['AllowSelfVotes']
-      render(json: { status: 'failed', message: 'You may not vote on your own posts.' }, status: :forbidden)
+      render(json: { status: 'failed', message: I18n.t('votes.limits.own_post') },
+             status: :forbidden)
+      return
+    end
+
+    if !current_user.privilege?('unrestricted') && !current_user.owns_post_or_parent?(post)
+      render(json: { status: 'failed', message: I18n.t('votes.limits.restricted_ability') },
+             status: :forbidden)
       return
     end
 

config/locales/strings/en.votes.yml

@@ -1,4 +1,7 @@
 en:
   votes:
     summary:
-      post_missing: 'Post not found'
+      post_missing: 'Post not found'
+    limits:
+      own_post: 'You may not vote on your own posts.'
+      restricted_ability: 'You must have the Participate Everywhere ability to vote on this post.'