diff --git a/collections.go b/collections.go index b85f0a4..66ad7a0 100644 --- a/collections.go +++ b/collections.go @@ -648,6 +648,16 @@ func processCollectionPermissions(app *App, cr *collectionReq, u *User, w http.R uname = u.Username } + // TODO: move this to all permission checks? + suspended, err := app.db.IsUserSuspended(c.OwnerID) + if err != nil { + log.Error("process protected collection permissions: %v", err) + return nil, err + } + if suspended { + return nil, ErrCollectionNotFound + } + // See if we've authorized this collection authd := isAuthorizedForCollection(app, c.Alias, r) diff --git a/posts.go b/posts.go index 9440ad8..547343b 100644 --- a/posts.go +++ b/posts.go @@ -1342,8 +1342,12 @@ func viewCollectionPost(app *App, w http.ResponseWriter, r *http.Request) error if c.IsPrivate() && (u == nil || u.ID != c.OwnerID) { return ErrPostNotFound } - if c.IsProtected() && ((u == nil || u.ID != c.OwnerID) && !isAuthorizedForCollection(app, c.Alias, r)) { - return impart.HTTPError{http.StatusFound, c.CanonicalURL() + "/?g=" + slug} + if c.IsProtected() && (u == nil || u.ID != c.OwnerID) { + if suspended { + return ErrPostNotFound + } else if !isAuthorizedForCollection(app, c.Alias, r) { + return impart.HTTPError{http.StatusFound, c.CanonicalURL() + "/?g=" + slug} + } } cr.isCollOwner = u != nil && c.OwnerID == u.ID diff --git a/templates/edit-meta.tmpl b/templates/edit-meta.tmpl index 6707e68..49c7781 100644 --- a/templates/edit-meta.tmpl +++ b/templates/edit-meta.tmpl @@ -270,7 +270,7 @@