| @@ -260,9 +260,16 @@ | ||
| 260 | 260 | if( $root_exists ) WPF()->topic->rebuild_threads( $topic, $root ); |
| 261 | 261 | |
| 262 | 262 | $post = apply_filters( 'wpforo_after_add_post_filter', $post, $topic, $forum ); |
| 263 | 263 | do_action( 'wpforo_after_add_post', $post, $topic, $forum ); |
| 264 | - | |
| 264 | + | |
| 265 | + // Set guest ownership cookie for secure edit verification. | |
| 266 | + // Uses the local $userid/$email actually written to the row, not the | |
| 267 | + // twice-filtered $post array, which addons may alter. | |
| 268 | + if( ! $userid && $email ) { | |
| 269 | + wpforo_add_guest_ownership( $postid ); | |
| 270 | + } | |
| 271 | + | |
| 265 | 272 | wpforo_clean_cache( 'post', $postid, $post ); |
| 266 | 273 | WPF()->notice->add( 'You successfully replied', 'success' ); |
| 267 | 274 | |
| 268 | 275 | return $postid; |
| @@ -313,13 +320,13 @@ | ||
| 313 | 320 | |
| 314 | 321 | if( ! is_user_logged_in() ) { |
| 315 | 322 | if( ! isset( $post['email'] ) || ! $post['email'] ) { |
| 316 | 323 | WPF()->notice->add( 'Permission denied', 'error' ); |
| 317 | - | |
| 324 | + | |
| 318 | 325 | return false; |
| 319 | - } elseif( ! wpforo_current_guest( $post['email'] ) ) { | |
| 326 | + } elseif( ! wpforo_guest_owns_post( $post['postid'] ) ) { | |
| 320 | 327 | WPF()->notice->add( 'You are not allowed to edit this post', 'error' ); |
| 321 | - | |
| 328 | + | |
| 322 | 329 | return false; |
| 323 | 330 | } |
| 324 | 331 | if( ! $args['name'] || ! $args['email'] ) { |
| 325 | 332 | WPF()->notice->add( 'Please insert required fields!', 'error' ); |
