From a6506c6c96124b38f4e26141b2e28c43ceb561a5 Mon Sep 17 00:00:00 2001
From: Bob Mottram <bob@freedombone.net>
Date: Wed, 14 Oct 2020 10:43:32 +0100
Subject: [PATCH] Ensure moderator status on the backend

---
 daemon.py | 39 ++++++++++++++++++++-------------------
 1 file changed, 20 insertions(+), 19 deletions(-)

diff --git a/daemon.py b/daemon.py
index 1d3327b1d..3ad6ad219 100644
--- a/daemon.py
+++ b/daemon.py
@@ -1645,7 +1645,7 @@ class PubServer(BaseHTTPRequestHandler):
             if debug:
                 print('You cannot perform an option action on yourself')
 
-        # view button on person option screen
+        # person options screen, view button
         if '&submitView=' in optionsConfirmParams:
             if debug:
                 print('Viewing ' + optionsActor)
@@ -1654,7 +1654,7 @@ class PubServer(BaseHTTPRequestHandler):
             self.server.POSTbusy = False
             return
 
-        # petname submit button on person option screen
+        # person options screen, petname submit button
         if '&submitPetname=' in optionsConfirmParams and petname:
             if debug:
                 print('Change petname to ' + petname)
@@ -1670,7 +1670,7 @@ class PubServer(BaseHTTPRequestHandler):
             self.server.POSTbusy = False
             return
 
-        # person notes submit button on person option screen
+        # person options screen, person notes submit button
         if '&submitPersonNotes=' in optionsConfirmParams:
             if debug:
                 print('Change person notes')
@@ -1718,22 +1718,23 @@ class PubServer(BaseHTTPRequestHandler):
         # person options screen, permission to post to newswire
         # See htmlPersonOptions
         if '&submitPostToNews=' in optionsConfirmParams:
-            postsToNews = None
-            if 'postsToNews=' in optionsConfirmParams:
-                postsToNews = optionsConfirmParams.split('postsToNews=')[1]
-                if '&' in postsToNews:
-                    postsToNews = postsToNews.split('&')[0]
-            newswireBlockedFilename = \
-                self.server.baseDir + '/accounts/' + \
-                optionsNickname + '@' + optionsDomain + '/.nonewswire'
-            if postsToNews == 'on':
-                if os.path.isfile(newswireBlockedFilename):
-                    os.remove(newswireBlockedFilename)
-            else:
-                noNewswireFile = open(newswireBlockedFilename, "w+")
-                if noNewswireFile:
-                    noNewswireFile.write('\n')
-                    noNewswireFile.close()
+            if isModerator(self.server.baseDir, chooserNickname):
+                postsToNews = None
+                if 'postsToNews=' in optionsConfirmParams:
+                    postsToNews = optionsConfirmParams.split('postsToNews=')[1]
+                    if '&' in postsToNews:
+                        postsToNews = postsToNews.split('&')[0]
+                newswireBlockedFilename = \
+                    self.server.baseDir + '/accounts/' + \
+                    optionsNickname + '@' + optionsDomain + '/.nonewswire'
+                if postsToNews == 'on':
+                    if os.path.isfile(newswireBlockedFilename):
+                        os.remove(newswireBlockedFilename)
+                else:
+                    noNewswireFile = open(newswireBlockedFilename, "w+")
+                    if noNewswireFile:
+                        noNewswireFile.write('\n')
+                        noNewswireFile.close()
             self._redirect_headers(usersPath + '/' +
                                    self.server.defaultTimeline +
                                    '?page='+str(pageNumber), cookie,