Add missing vote permission check #28 (beta 13)

FriendsOfFlarum · Dec 1, 2020 · 0ed630d · 0ed630d
1 parent ddc51f4
commit 0ed630d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/Commands/VotePollHandler.php b/src/Commands/VotePollHandler.php
@@ -48,7 +48,7 @@ public function handle(VotePoll $command)
 
  $optionId = Arr::get($data, 'optionId');
 
- if ($poll->hasEnded()) {
+ if ($poll->hasEnded() || !$actor->can('votePolls')) {
  throw new PermissionDeniedException();
  }