| @@ -84,13 +84,13 @@ | ||
| 84 | 84 | |
| 85 | 85 | if( ! is_user_logged_in() ) { |
| 86 | 86 | if( ! isset( $topic['email'] ) || ! $topic['email'] ) { |
| 87 | 87 | WPF()->notice->add( 'Permission denied', 'error' ); |
| 88 | - | |
| 88 | + | |
| 89 | 89 | return false; |
| 90 | - } elseif( ! wpforo_current_guest( $topic['email'] ) ) { | |
| 90 | + } elseif( ! wpforo_guest_owns_post( $topic['first_postid'] ) ) { | |
| 91 | 91 | WPF()->notice->add( 'You are not allowed to edit this post', 'error' ); |
| 92 | - | |
| 92 | + | |
| 93 | 93 | return false; |
| 94 | 94 | } |
| 95 | 95 | } |
| 96 | 96 | |
| @@ -503,9 +503,15 @@ | ||
| 503 | 503 | if( $tags && ! $status && ! $private ) $this->add_tags( $tags ); |
| 504 | 504 | |
| 505 | 505 | $topic = apply_filters( 'wpforo_after_add_topic_filter', $args, $forum ); |
| 506 | 506 | do_action( 'wpforo_after_add_topic', $topic, $forum ); |
| 507 | - | |
| 507 | + | |
| 508 | + // Set guest ownership cookie for secure edit verification. | |
| 509 | + // Uses the local $userid/$email actually written to the post row. | |
| 510 | + if( ! $userid && $email ) { | |
| 511 | + wpforo_add_guest_ownership( $first_postid ); | |
| 512 | + } | |
| 513 | + | |
| 508 | 514 | wpforo_clean_cache( 'topic', $topicid, $topic ); |
| 509 | 515 | if( $status ) { |
| 510 | 516 | WPF()->notice->add( 'Your topic successfully added and awaiting moderation', 'success' ); |
| 511 | 517 | } else { |
